CVE-2026-109147
CVE-2026-109147 · WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
wp booking system
- Versions
- ≥ 0, < 2.1.0.3: Affected (semver)
Update to 2.1.0.3