CVE-2026-73402
MediumCVSS 6.5Summary
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
Risk Assessment
The risk includes the possibility of executing malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or malware propagation.
Recommendation
It is recommended to update WP BASE Booking to the latest version and implement input and output filtering to prevent XSS.
Other vulnerabilities in WP BASE Booking
See all- CVE-2026-59541High
The WP BASE Booking plugin version 6.3.1 and earlier allows a user with the Subscriber role to escalate their privileges. An attacker can gain access to functions reserved for administrators.
- CVE-2026-61962Critical
Unauthenticated Arbitrary Code Execution vulnerability in WP BASE Booking versions up to 6.3.0. An attacker can execute arbitrary code without authentication.
- CVE-2026-39587High
There is a vulnerability in WP BASE Booking versions up to 5.9.0 that allows unauthenticated privilege escalation.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.