CVE-2026-92561
MediumCVSS 6.1Summary
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to and including 11.8.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled.
Risk Assessment
An attacker could steal user data, hijack sessions, or spread malicious content. This may lead to compromise of user security and site reputation.
Recommendation
Update the Booking Calendar plugin to the latest version with the fix. Additionally, consider using a web application firewall (WAF) and regularly scan the site for XSS.
Other vulnerabilities in Booking Calendar
See all- CVE-2026-92619High
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 11.8.2 via the wpbc_ajax_option_save AJAX action. An authenticated attacker with Editor-level access can write WordPress options such as default_role=administrator and create an administrator account.
- CVE-2026-74002Medium
Unauthenticated Broken Access Control vulnerability in Booking Calendar plugin up to version 11.7. Unauthenticated users can access booking and management functions that should be restricted.
- CVE-2026-59558High
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Booking Calendar plugin up to version 11.4.2. Allows an attacker to inject malicious scripts into the page.
Original NVD description (English source)
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification.