The Booking System Trafft WordPress plugin suffers from a stored XSS vulnerability (CWE-79) due to improper input neutralization in the bookingWebsiteUrl setting. In agency mode, the set_options AJAX action lacks a capability check, allowing any authenticated user to update the trafft_option with a malicious bookingWebsiteUrl. Although a nonce is verified, it is accessible to all authenticated users, including those with Subscriber-level privileges. The malicious URL is used by the trafftAdminAssets() function to enqueue a script on all front-end pages with the booking shortcode, leading to arbitrary JavaScript execution in site visitors' browsers, including administrators. No official patch or remediation guidance is currently available.

An authenticated attacker with Subscriber-level access or higher can inject a malicious script URL that is loaded on all front-end pages using the booking shortcode. This enables execution of arbitrary JavaScript in the browsers of all site visitors, including administrators, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only and consider disabling agency mode if feasible. Monitor official channels for updates and apply any official fixes promptly once released.