The WP Booking System – Booking Calendar plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input in URL query parameters. Specifically, the plugin uses add_query_arg and remove_query_arg functions without appropriate escaping, enabling attackers to inject arbitrary web scripts. This vulnerability affects all versions up to and including 2.0.19.8. An unauthenticated attacker can exploit this by convincing a user to click a maliciously crafted link, causing the injected script to execute in the context of the affected site.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when they click a crafted link. This can lead to information disclosure, session hijacking, or other actions permitted by the victim's privileges in the affected site. The vulnerability does not require authentication and has no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links received from untrusted sources and consider disabling or replacing the affected plugin. Monitor the vendor's communications for updates regarding a security patch.