CVE-2026-85303: WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability

Q: What access and user interaction are required for exploitation?

An attacker needs low-level privileges to exploit the issue, and a victim must interact with the malicious content. The attack can be performed over the network with low attack complexity.

Q: What is the potential impact of a successful exploit?

The vulnerability is a stored XSS issue with scope changed. It may allow limited impact to confidentiality, integrity, and availability in a different security authority.

Q: Which plugin versions are affected?

Booking and Rental Manager versions through 2.7.7 are affected. The provided information does not identify a fixed version.

Published Sep 3, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS.

This issue affects Booking and Rental Manager: from n/a through 2.7.7.

Affected Software

1 affected component

Magepeople inc. Booking and Rental Manager<=2.7.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Booking and Rental Manager plugin to a version that resolves this vulnerability.
Fixed in 2.7.8

Event History

Sep 3, 2026

CVE Published

via MITRE·04:51 PM

Data Sourced

via MITRE·04:51 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access and user interaction are required for exploitation?

An attacker needs low-level privileges to exploit the issue, and a victim must interact with the malicious content. The attack can be performed over the network with low attack complexity.

What is the potential impact of a successful exploit?