The Booking Calendar plugin for WordPress contains a reflected cross‑site scripting flaw that is triggered when the wpbc_auto_fill parameter is passed in a URL. Because the plugin does not sanitize or escape this input before echoing it back to the page, an attacker can embed arbitrary JavaScript that will run in the browser of any user who follows a crafted link. This is a client‑side code execution vulnerability that can occur without authentication.

WordPress sites that have the wpdevelop Booking Calendar plugin installed in a version equal to or older than 11.8.3 are affected. All releases up through 11.8.3 contain the flaw. Sites that have migrated to a newer version have fixed the issue.

The CVSS score of 6.1 indicates a moderate severity for this vulnerability. No EPSS data is available and it is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. The attack vector is a typical reflected XSS scenario: an unauthenticated attacker sends a malicious link containing a crafted wpbc_auto_fill parameter to a victim; the victim’s browser then executes the injected script when the link is clicked.