The flaw allows unauthenticated attackers to store malicious scripts by submitting values for the hb_country_iso, hb_usa_state_iso, and hb_canada_province_iso parameters. The supplied script is persisted in the HBook Customer admin page and will execute whenever a user views that page, granting an attacker arbitrary code execution within the WordPress environment.

All installations of Omnivo Booking Calendar – Event Calendar for WordPress that run version 2.1.6 or earlier are vulnerable.

The CVSS score of 7.2 indicates moderate to high severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Because the weakness is unauthenticated and relies on stored data, an attacker can inject script from any source, causing data theft, session hijacking, or site defacement. Typical exploitation involves submitting crafted parameter values through the plugin interface or via a crafted HTTP request, which the plugin then serves to visitors without sanitizing the content.