This vulnerability in ThimPress WP Hotel Booking (<= 2.2.8) is a DOM-based cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction can exploit this to execute malicious scripts in the context of the affected web application. The CVSS score is 5.9 (medium), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with limited impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary scripts in the victim's browser, potentially leading to limited disclosure or modification of information and partial disruption of service. However, the impact is constrained by the need for user interaction and elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and limit user interaction with untrusted content within the affected plugin environment.