The BA Book Everything plugin for WordPress allows unauthenticated users to store malicious JavaScript within the first_name field of a booking entry—a classic stored cross‑site scripting flaw. When a user later views a page that displays the stored name, the injected script executes with the visitor’s privileges, enabling session hijacking, defacement, or other client‑side attacks. The vulnerability arises from insufficient input validation and output escaping surrounding the first_name parameter, allowing arbitrary script tags to persist in the database.

Both the bookingalgorithms vendor and the BA Book Everything WordPress plugin are affected. All releases up to and including version 1.8.27 contain the flaw. WordPress sites that have installed any of these plugin versions are vulnerable.

The CVSS rating of 7.2 signals moderate to high severity. No EPSS score is currently published, so the probability of exploitation remains unclear, and the flaw is not yet listed in the CISA KEV catalog. Attackers can achieve the exploit chain from the public booking form: an unauthenticated guest booking generates an order_id, order_num, and order_hash that can be reused to reach the vulnerable action_to_pay() handler. Because the initial step is fully open to anyone, the full attack is achievable without any user credentials.