CVE-2026-28040
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Magepeople inc. Taxi Booking Manager for WooCommerce contains a Stored Cross-site Scripting vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 2.0.0.
Risk Assessment
Malicious script stored in the application may execute in the browsers of users visiting the site. This can lead to session theft or unauthorized actions.
Recommendation
Upgrade Taxi Booking Manager for WooCommerce to a version later than 2.0.0 if available. Implement input validation and encoding in forms.
Other vulnerabilities in Taxi Booking Manager for WooCommerce
See all- CVE-2026-114181Medium
Missing Authorization in the Magepeople inc. Taxi Booking Manager for WooCommerce plugin allows exploitation of incorrectly configured access control security levels. This issue affects Taxi Booking Manager for WooCommerce through version 2.1.6.
- CVE-2026-103351Medium
The Taxi Booking Manager for WooCommerce WordPress plugin contains an improper validation of specified quantity in input vulnerability, allowing input data manipulation. The issue affects versions up to and including 2.1.1.
- CVE-2026-93928High
The Taxi Booking Manager for WooCommerce plugin by Magepeople inc. contains an Authentication Bypass vulnerability using an alternate path or channel. This issue affects versions before 2.0.8.
- CVE-2026-73363Medium
Unauthenticated Broken Access Control vulnerability in Taxi Booking Manager for WooCommerce versions prior to 2.0.8. An attacker without authentication can exploit this to perform unauthorized actions.
- CVE-2026-27345High
The Taxi Booking Manager for WooCommerce plugin versions up to 2.0.3 have an unauthenticated broken access control vulnerability. An unauthenticated user may gain unauthorized access to certain functions or data.
- CVE-2026-25426Medium
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows exploiting incorrectly configured access control security levels. This affects versions from n/a through 2.0.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS