The Booking and Rental Manager WordPress plugin by magepeopleteam suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'active_tab' parameter. This parameter is not properly sanitized or escaped before being included in web pages, enabling unauthenticated attackers to inject malicious scripts. The vulnerability affects all versions up to 2.2.1. Exploitation requires a user to access a page containing the injected script, which then executes in the user's browser context. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the affected website for any user who visits the injected page. This can lead to theft of user session data, defacement, or other malicious actions limited to the scope of the injected script. The impact is rated medium severity with limited confidentiality and integrity impact and no availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or parameter. Applying web application firewall (WAF) rules to block suspicious input targeting the 'active_tab' parameter may help mitigate risk. Monitor official magepeopleteam communications for updates and apply patches promptly once available.