This vulnerability in code-projects Online Hotel Booking 1.0 allows remote attackers to perform cross-site scripting by manipulating the roomname parameter in the /booknow.php Booking Endpoint. The CVSS 4.0 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on integrity. Exploits are publicly available, but no known active exploitation in the wild has been reported. No official patch or remediation level has been provided by the vendor or authoritative sources.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to user session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and does not affect confidentiality or availability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the roomname parameter as a temporary mitigation. Monitor vendor channels for updates regarding an official patch or workaround.