This vulnerability (CVE-2026-59558) in the wpdevelop Booking Calendar plugin allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks due to improper input neutralization during web page generation. It affects versions up to and including 11.4.2. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low to low and low respectively. No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected Booking Calendar pages. This may lead to limited disclosure of information, modification of data, or disruption of service within the scope of the affected web application. The vulnerability requires user interaction but no authentication, increasing its risk profile. However, there are no known exploits reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, consider applying temporary mitigations such as input validation or disabling the affected plugin if feasible.