Executive brief
The Bookero.pl plugin for WordPress, which provides online booking and reservation functionality, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. When other users or administrators visit these pages, the injected scripts will execute in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
The Bookero.pl plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the bookero_products() function. Specifically, the 'hide_products' and 'filter_products' attributes of the [bookero_products] shortcode are concatenated directly into an inline JavaScript block without proper escaping. An authenticated attacker with contributor-level permissions or higher can exploit this to inject arbitrary web scripts into a post or page. These scripts will execute in the context of any user's browser who views the affected page. The vulnerability is present in versions up to and including 2.2.
Affected products
- safistudio Bookero.pl – system rezerwacji online up to and including 2.2
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
References
- https://plugins.trac.wordpress.org/browser/bookeropl/tags/2.1/libraries/bookero-front.php
- https://plugins.trac.wordpress.org/browser/bookeropl/tags/2.1/libraries/bookero-front.php
- https://plugins.trac.wordpress.org/browser/bookeropl/trunk/libraries/bookero-front.php
- https://plugins.trac.wordpress.org/browser/bookeropl/trunk/libraries/bookero-front.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3524452%40bookeropl&new=3524452%40bookeropl
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fd0e6ca6-f6a7-4e81-aea1-3b59de0173d6?source=cve