A reflected cross-site scripting vulnerability in the EZiHosting Tennis Court Bookings plugin exposes users to potential session hijacking and malicious script execution.

This flaw is a reflected cross-site scripting (CWE-79) vulnerability occurring due to improper neutralization of user-supplied input during web page generation. The vulnerability is exploitable by an unauthenticated attacker who can entice a user to click a specially crafted link.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to the theft of session cookies, unauthorized actions performed on behalf of the user, or the redirection of users to malicious websites. Given the CVSS score of 7.1, this is a high-severity issue that could significantly impact user trust and the integrity of the web application.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official WordPress plugin repository for security updates and apply them as soon as they become available.

Proactive Monitoring: Review web access logs for suspicious URL parameters containing encoded script tags or unusual JavaScript patterns.

Compensating Controls: Implement a robust Content Security Policy (CSP) and deploy a Web Application Firewall (WAF) to detect and block common cross-site scripting patterns in incoming HTTP requests.

Public Exploit Available: Unknown.

This vulnerability poses a significant risk to application users due to the potential for session compromise. Organizations utilizing the Tennis Court Bookings plugin should prioritize updating the software immediately upon the release of a vendor fix. In the absence of an update, consider disabling the plugin if it is not mission-critical to prevent potential exploitation.