The WP Hotel Booking WordPress plugin (<=2.3.2) suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'widget_search' shortcode attribute. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts due to inadequate input sanitization and output escaping. The injected scripts execute when users visit the compromised pages, but exploitation requires browsers that support access keys since the payload is stored in a hidden attribute. No official remediation or patch has been confirmed as of the published date.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. This can lead to execution of arbitrary scripts in the context of users visiting those pages, potentially resulting in information disclosure or session manipulation. The impact is limited by the requirement for authenticated access and browser support for access keys. There is no indication of denial of service or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to shortcode usage. Avoid using the 'widget_search' shortcode attribute in untrusted contexts. Follow the vendor's updates for any forthcoming patches or official mitigations.