This vulnerability is an instance of improper neutralization of input during web page generation, known as reflected cross‑site scripting. The plugin exposes a user‑input field that is inserted directly into the page without proper escaping or sanitization, allowing an attacker to inject arbitrary HTML or JavaScript that will be executed in the browsers of users who visit the affected endpoint.

Affected systems are WordPress sites running the Salon booking system plugin from vendors Dimitri Grassi. All releases up to and including version 10.31.5 contain the flaw; earlier versions are implicitly affected as well because the vulnerability exists in the code base prior to the stated release.

The CVSS score of 7.1 classifies the flaw as high severity, and although there is no EPSS data, the lack of a KEV listing does not diminish the likelihood that attackers could target this plugin. The attack requires only a crafted URL or malicious link and does not need authentication, making the exploitation path simple for anyone who can influence a user’s browser to load the reflected payload. The resulting script execution could hijack user sessions, perform phishing, or deface content.