CVE-2026-57639
HighCVSS 7.1Summary
The WP Booking System plugin by Roland Murg up to 2.1.0.6 does not properly neutralize input during web page generation, allowing a Reflected XSS attack. The issue affects versions from n/a through 2.1.0.6.
Risk Assessment
An attacker could trick a user into clicking a crafted link and execute malicious script in their browser within the site context. This may lead to session or credential theft.
Recommendation
Update the WP Booking System plugin to a version later than 2.1.0.6. Additionally, deploy security headers such as Content-Security-Policy.
Other vulnerabilities in WP Booking System
See all- CVE-2026-108123High
The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.3 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII.
- CVE-2026-57367High
The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS