An unauthenticated Stored Cross-Site Scripting vulnerability in the WPBookit plugin allows attackers to inject malicious scripts into web pages, posing a significant risk to site integrity and user security.

This is a Stored Cross-Site Scripting (CWE-79) vulnerability triggered via the wpb_user_name and wpb_user_email parameters. The vulnerability is exploitable by unauthenticated attackers, as the plugin fails to properly sanitize input or escape output before rendering it to users.

The vulnerability carries a CVSS score of 7.2, which reflects the high potential for impact despite the absence of full system compromise. Successful exploitation could allow attackers to execute arbitrary scripts in the browsers of site visitors, leading to session hijacking, unauthorized actions on behalf of users, or the redirection of traffic to malicious sites. This poses a direct risk to user data privacy and the overall reputation of the website.

Immediate Action: Since a specific patch version is currently unknown, administrators should deactivate the WPBookit plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor server logs for unusual HTTP requests targeting the booking shortcode controller or unexpected script injections within user-facing pages.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious script injection attempts targeting the affected parameters.

Public Exploit Available: No (exploit_available: false)

Given the severity of this vulnerability and the ability for unauthenticated actors to execute malicious code, prompt action is required. Administrators must prioritize the removal or deactivation of the vulnerable plugin until the developer provides a confirmed fix. Failure to address this could lead to widespread client-side attacks against your user base.