The WP Booking System WordPress plugin prior to 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
wpbookingsystem wp booking system