This vulnerability (CVE-2024-31117) in the WooCommerce Bookings Calendar plugin is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). It affects all versions up to 1.0.36. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and impacts on confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is provided, and the plugin is not a cloud service, so remediation depends on the vendor releasing a fix.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The scope is changed, indicating the vulnerability affects resources beyond the initially vulnerable component. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, consider limiting user privileges and exercising caution with user-generated content to reduce exposure.