CVE-2026-107126
8.8HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-79
Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, leading to full site takeover. They only need network access to submit malicious input, which triggers when an admin views the booking records.
Root cause
The plugin stores unvalidated, client-controllable input and outputs it directly into an admin dashboard page without sanitization or escaping.
Affected systems
WP Booking System plugin for WordPress before 2.1.0.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the WP Booking System plugin to version 2.1.0.1 or higher. If patching must wait, deactivate the plugin immediately.
$ wp plugin update wp-booking-systemAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.