Executive brief
The Booking Manager plugin for WordPress, which is used to manage reservations and bookings, contains a security vulnerability that allows for stored cross-site scripting. An attacker with basic user permissions could inject malicious scripts into the website's database. If an administrator or another user views the affected page, these scripts could execute, potentially leading to unauthorized actions, data theft, or website defacement.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the wpdevelop Booking Manager plugin (booking-manager) for WordPress due to improper neutralization of input during web page generation. The flaw affects versions up to and including 2.1.18. An attacker with low-level privileges (PR:L) can inject malicious JavaScript into the application's database. Because the input is not properly sanitized before being rendered back to users, the script executes in the context of the victim's browser session when they visit the compromised page. This can lead to session hijacking, unauthorized administrative actions, or redirection to malicious sites. Users are advised to update to a version higher than 2.1.18 if available.
Affected products
- wpdevelop Booking Manager <= 2.1.18
Timeline
- 2026-05-27: disclosed: Initial publication of the CVE record.
- 2026-05-27: advisory: Advisory published by Patchstack.