CVE-2026-96039

14th percentile - higher than 14% of all known CVEs

The BA Book Everything plugin for WordPress (versions up to and including 1.8.27) is vulnerable to stored cross-site scripting via the first_name parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.

An attacker can execute arbitrary JavaScript in a victim's browser, potentially leading to session theft or other actions. The risk is high because the attack does not require authentication and is easy to perform.

Update the plugin to a version newer than 1.8.27 if available. Otherwise, consider disabling the plugin or applying WAF rules.