The Booking Calendar plugin for WordPress is affected by a reflected Cross-Site Scripting vulnerability that could allow unauthenticated attackers to execute arbitrary scripts within the context of a victim session.

This vulnerability is a reflected Cross-Site Scripting (CWE-79) flaw caused by insufficient input sanitization and output escaping on the wpbc_auto_fill parameter. Unauthenticated attackers can trigger this issue by tricking a user into interacting with a specially crafted malicious link.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the browser of an unsuspecting user. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive information, potentially resulting in compromised user accounts or internal data exposure. Given the CVSS score of 6.1, this represents a significant medium severity risk that requires attention to prevent account takeover scenarios.

Immediate Action: Update the Booking Calendar plugin to the latest available version provided by wpdevelop to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Monitor web server access logs for anomalous request patterns involving the wpbc_auto_fill parameter or unusual URL structures containing script tags.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured XSS protection rules to detect and block malicious payloads targeting the vulnerable parameter.

Public Exploit Available: No (exploit_available unknown).

Organizations utilizing the Booking Calendar plugin must prioritize updating to the latest version to neutralize this cross-site scripting vector. While the vulnerability requires user interaction, the impact on authenticated user sessions warrants immediate patching to maintain the security and integrity of the WordPress environment.