7.1Hoch

CVE-2026-109147WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter

WP Booking System Veröffentlicht: 2026-10-21 09:00 (vor 12 Tagen)

Beschreibung

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
—	WP Booking System	< 2.1.0.3

Referenzen und Patches

https://wpscan.com/vulnerability/2a2e58bd-dc3f-4b6f-9b2d-b6d15cd2e898/ exploitvdb-entrytechnical-description

CVSS-Score

7.1Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Niedrig
Integrität: Niedrig
Verfügbarkeit: Niedrig

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Alle Scores (2)

CISA-ADP	CVSS 3.1	7.1Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.1Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.24%

höher als 15 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-10-12
Veröffentlicht2026-10-21 09:00
Bei IP-DB eingegangen2026-10-24 23:46
Zuletzt aktualisiert2026-10-21 21:37

Vergeben von (CNA): WPScan
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

5.9Mittel

CVE-2026-111464 vor 1 Stunde

WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

emrevona WP Fastest Cache – WordPress Cache Plugin

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* c…

9.8Kritisch

CVE-2026-86596 vor 6 Stunden

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…

9.8Kritisch

CVE-2026-102435 vor 8 Stunden

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

themefic Ultra Addons for Contact Form 7

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated att…

5.3Mittel

CVE-2026-103310 vor 20 Stunden

PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

PayHere Payment Gateway

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation a…

6.5Mittel

CVE-2026-119480 gestern

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

Crocoblock JetFormBuilder

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

9.3Kritisch

CVE-2026-62048 gestern

WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Liquid Web / StellarWP BookIt

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.