CVE-2026-107126: WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by supplying a client-controllable request value, specifically through the X-Forwarded-For header. Exploitation does not require a WordPress account.
When does the injected script execute?
The attacker-controlled value is stored and executes later when an administrator views the affected stored data in an administration screen. The impact therefore depends on an administrator opening that screen while authenticated.
Which versions are affected?
WP Booking System versions before 2.1.0.1 are affected. Version 2.1.0.1 is the version identified as no longer affected.