CVE-2026-103305: Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

Q: Which deployments are affected?

WordPress sites using the Prenotazioni plugin version 1.7.5 or earlier are affected.

Q: Does exploitation require an authenticated WordPress account or user interaction?

No authenticated account is required to save the vulnerable settings. The stored payload is then executed when an administrator or site visitor views output containing the unescaped setting.

Q: What security controls are missing in the vulnerable settings update path?

The plugin does not enforce authorization or CSRF checks when saving settings. Some saved settings are also not escaped when rendered, enabling stored XSS.

Published Oct 11, 2026

Updated

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.

Affected Software

1 affected component

WordPress Prenotazioni<=1.7.5

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Which deployments are affected?

WordPress sites using the Prenotazioni plugin version 1.7.5 or earlier are affected.

Does exploitation require an authenticated WordPress account or user interaction?

No authenticated account is required to save the vulnerable settings. The stored payload is then executed when an administrator or site visitor views output containing the unescaped setting.

What security controls are missing in the vulnerable settings update path?

The plugin does not enforce authorization or CSRF checks when saving settings. Some saved settings are also not escaped when rendered, enabling stored XSS.

CVE-2026-103305: Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated WordPress account or user interaction?

What security controls are missing in the vulnerable settings update path?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require an authenticated WordPress account or user interaction?

What security controls are missing in the vulnerable settings update path?