The ameliabooking Booking System Trafft contains a stored XSS vulnerability due to improper input sanitization during web page generation. This flaw affects versions up to 1.0.14 and allows attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. No patch or official remediation information is currently available.

Successful exploitation of this stored XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts by executing arbitrary scripts in users' browsers. This may allow attackers to steal session tokens, manipulate web content, or perform actions on behalf of authenticated users. However, the attack requires user interaction and some privileges, reducing the overall risk severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates and apply patches promptly once released.