This vulnerability in Webba Booking plugin (<= 6.0.5) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges and user interaction can inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts as reflected by the CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L). No patch or official fix information is currently provided.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited to confidentiality, integrity, and availability at a low level, consistent with the medium severity rating. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and be cautious with user interactions that could trigger stored XSS payloads. Monitor vendor channels for updates and apply patches promptly once released.