CVE-2024-6930 is a stored cross-site scripting vulnerability (CWE-79) in the WP Booking Calendar WordPress plugin. It affects all versions up to 10.2.1 due to improper neutralization of user input in the 'type' attribute of the bookingform shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows authenticated users with contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who access the affected pages, potentially leading to unauthorized actions or data exposure limited to the confidentiality and integrity of the affected site. There is no reported impact on availability. The vulnerability could be leveraged to compromise user sessions or perform actions on behalf of users viewing the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the bookingform shortcode with user-supplied attributes. Monitor official wpdevelop communications for updates and apply any released patches promptly.