CVE-2026-88825

HighCVSS 8.8

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the settings, and in the browser of any visitor to a page displaying the booking widget.

Risk Assessment

An attacker can inject malicious scripts (XSS) that execute in the administrator's and visitors' browsers, leading to session hijacking or data theft.

Recommendation

Update the plugin to version 2.0 or later. Check widget settings for injected scripts.

Other vulnerabilities in iGMS Direct Booking

CVE-2026-39652Medium
The iGMS Direct Booking WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.3.

Original NVD description (English source)

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS