The HotelRunner Booking Widget by integrationshotelrunner contains a CSRF vulnerability that can be exploited to inject stored XSS payloads. This affects all versions up to 1.6. The vulnerability allows attackers to trick authenticated users into submitting unauthorized requests, which can result in persistent cross-site scripting attacks. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this CSRF vulnerability can lead to stored XSS, which may allow attackers to execute malicious scripts in the context of the affected application. This can compromise user sessions, steal sensitive information, or perform unauthorized actions. The overall impact is rated high due to the combination of CSRF and stored XSS, affecting confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and validating the origin of requests. Additionally, applying input sanitization and output encoding can help mitigate stored XSS risks. Monitor vendor communications for updates on patches or official fixes.