A Cross-Site Scripting vulnerability in the Booking calendar, Appointment Booking System plugin for WordPress may allow unauthorized actors to execute arbitrary scripts in a user browser.

This is a Cross-Site Scripting (CWE-79) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users.

Successful exploitation of this XSS vulnerability can lead to session hijacking, unauthorized actions performed on behalf of authenticated users, and potential defacement of the affected website. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and confidentiality of the WordPress environment.

Immediate Action: Administrators should monitor the vendor website for the release of a security update and apply it immediately upon availability.

Proactive Monitoring: Review web application logs for suspicious characters or script tags being submitted to input fields or parameters within the plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS attack patterns directed at the plugin.

Public Exploit Available: No (exploit_available: unknown)

Given the high severity of this vulnerability, administrators should prioritize the remediation of this plugin. If an official patch is not immediately available, consider disabling the plugin functionality or restricting access to the affected components until a secure version is deployed.