A critical stored cross-site scripting vulnerability in the iGMS Direct Booking plugin allows unauthenticated attackers to inject malicious scripts, potentially compromising administrator accounts and site visitors.

This vulnerability (CWE-79) exists because the plugin fails to perform authorization or output escaping on widget appearance settings. An unauthenticated attacker can inject arbitrary web scripts that execute within the session of an administrator or the browsers of site visitors.

The ability for an unauthenticated attacker to execute arbitrary scripts poses a severe risk to organizational data integrity and user security. With a CVSS score of 8.8, this flaw facilitates session hijacking, unauthorized administrative actions, and the potential for large scale redirection of site traffic to malicious domains.

Immediate Action: Update the iGMS Direct Booking plugin to version 2.0 or later immediately to resolve the lack of sanitization.

Proactive Monitoring: Review administrative audit logs for unusual configuration changes and monitor web traffic for suspicious script execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS payloads and malicious script injection attempts targeting widget parameters.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for unauthenticated remote exploitation, administrators must prioritize patching this plugin. If an immediate update is not feasible, consider disabling the iGMS Direct Booking widget until the patch can be verified and applied in a staging environment.