This vulnerability, identified as CWE-79, involves improper input sanitization in Beds24 Online Booking software, enabling stored cross-site scripting attacks. An attacker with high privileges and requiring user interaction can inject malicious scripts that persist in the application and execute in the context of other users' browsers. The vulnerability affects versions through 2.0.23. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, with impact on confidentiality, integrity, and availability rated as low to low-medium. No patch or official remediation level has been published by the vendor, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in other users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and high privileges, limiting the attack scope. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and apply input validation or sanitization controls where possible to reduce risk. Monitor vendor communications for updates on patches or official mitigations.