The Amelia Booking plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts through the admin settings interface. This vulnerability specifically impacts multi-site WordPress installations or those with unfiltered_html disabled, allowing malicious scripts to execute in the context of other users viewing the injected pages. The issue affects all versions up to 1.1.5 (standard) and 7.5.1 (Pro). No official patch or remediation information is provided in the data.

An attacker with administrator-level access can inject persistent malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure or other impacts associated with cross-site scripting. The vulnerability does not allow privilege escalation or denial of service directly but can facilitate further attacks leveraging the injected scripts. The impact is limited to multi-site or restricted unfiltered_html environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling multi-site installations or enabling unfiltered_html if feasible. Monitor vendor channels for updates and apply patches promptly once released.