CVE-2026-57639: WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Booking Systemto a version that resolves this vulnerability.Fixed in 2.1.0.7
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The vulnerability is reflected XSS and has no required privileges, but exploitation requires user interaction. An attacker would need to cause a user to interact with a crafted request or page that triggers the vulnerable input handling.
Which installations are affected?
WP Booking System versions through 2.1.0.6 are affected. The provided data does not identify configuration-specific prerequisites or exclusions.
What is the likely impact if exploitation succeeds?
The reported vector is network-accessible, with low attack complexity and no required privileges. The CVSS vector indicates low impacts to confidentiality, integrity, and availability, with impacts potentially extending beyond the vulnerable component's security scope.