CVE-2026-92561: Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'bookingisnonceatfrontend' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking Calendar (WordPress plugin)to a version that resolves this vulnerability.Fixed in 11.8.2 - Configuration
Enable nonce checks on the front end by turning on the 'booking_is_nonce_at_front_end' option so unauthenticated requests cannot bypass the nonce verification.
Booking Calendar (WordPress plugin) booking_is_nonce_at_front_end = disabled
Event History
Frequently Asked Questions
Who can exploit this issue, and what is required?
An unauthenticated attacker can submit a crafted request containing malicious script in the options parameter. Successful exploitation requires persuading a user to perform an action such as clicking a malicious link.
Are default plugin installations affected?
Yes. The booking_is_nonce_at_front_end option is disabled by default, which bypasses the nonce check and lets unauthenticated requests reach the vulnerable code path.
Which plugin versions are affected?
All Booking Calendar plugin versions through 11.8.2, including 11.8.2, are affected.