The themewant Easy Hotel Booking plugin suffers from a DOM-based Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This affects versions up to 1.9.0 and could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, indicating medium severity. No patch or official remediation guidance is currently provided.

Successful exploitation could lead to partial compromise of confidentiality, integrity, and availability of the affected system due to execution of attacker-controlled scripts in the user's browser context. The attack requires user interaction and low privileges, limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges and minimizing exposure to untrusted inputs in the affected plugin. Monitor vendor channels for updates and apply patches promptly once released.