CVE-2026-109147
WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 21, 2026
- Updated
- Oct 21, 2026
- Reserved
- Oct 12, 2026
Description
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
WP Booking SystemUnknown |
|
References
- https://wpscan.com/vulnerability/2a2e58bd-dc3f-4b6f-9b2d-b6d15cd2e898/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.