The vulnerability resides in the Booking System Trafft WordPress plugin, where an authenticated user with Subscriber-level privileges can call the set_options AJAX action to update the bookingWebsiteUrl setting without any capability verification. Because the value is later used to enqueue an external script, attackers can inject a malicious URL that loads arbitrary JavaScript into the browsers of all site visitors, including administrators. This constitutes a stored cross‑site scripting flaw (CWE‑79) that enables arbitrary client‑side code execution on the affected site, compromising the confidentiality and integrity of users’ browser contexts.

The affected product is the Booking System Trafft plugin by ameliabooking, with all releases through version 1.0.17 vulnerable. Users of any earlier or newer unpatched releases are not impacted unless they have not updated.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of < 1% suggests a low likelihood of exploitation in current traffic. The vulnerability is not listed as a known exploited vulnerability in the CISA KEV catalog. Exploitation requires only an authenticated Subscriber or higher role and the ability to perform the set_options AJAX call, which the plugin exposes on any admin page. Once the attacker sets the bookingWebsiteUrl to a malicious domain, the embedded script runs automatically for every visitor who visits a page rendering the booking shortcode, making the impact widespread if the plugin is active on high‑traffic sites.