CVE-2026-42751
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Booking Manager plugin (through 2.1.18) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be stored and executed in a user's browser.
Risk Assessment
An attacker can store a script that executes in the session of an administrator or users, potentially leading to session hijacking or data modification. This affects the security of the WordPress site.
Recommendation
Update the Booking Manager plugin to a version later than 2.1.18. Consider additional input filtering and CSP deployment.
Other vulnerabilities in Booking Manager
See all- CVE-2026-91025Medium
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's plugin-specific settings targets the requesting user's own account. Any authenticated user with subscriber-level access and above can create or overwrite the plugin's per-user settings on arbitrary users, including administrators.
- CVE-2026-91024Medium
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query. Authenticated users with Author-level access and above can perform SQL injection attacks by importing a feed they control.
- CVE-2025-64275Medium
The Booking Manager plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Manager versions from n/a through <= 2.1.17.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS