Executive brief
The Booking System Trafft plugin for WordPress, which is used to manage appointments and bookings, contains a security flaw that allows low-level users to inject malicious scripts into the website. By exploiting a missing permission check, an attacker with a basic account (such as a subscriber) can redirect the plugin's script loader to a malicious source. This could lead to the theft of visitor data, unauthorized actions on behalf of site administrators, or full website defacement.
Technical details
The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to a missing capability check in the `trafftSetOptions()` handler, which processes the `set_options` AJAX action. While the handler verifies a nonce, this nonce is exposed to all authenticated users on various admin pages. An attacker with Subscriber-level access or higher can exploit this to update the `bookingWebsiteUrl` option. This value is subsequently used by `trafftAdminAssets()` to enqueue a remote JavaScript file (`embed.js`) on any page using the booking shortcode. This allows for arbitrary JavaScript execution in the context of site visitors and administrators. The vulnerability is present in all versions up to and including 1.0.17.
Affected products
- ameliabooking Booking System Trafft <= 1.0.17
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
References
- https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php
- https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php
- https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php
- https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php
- https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php
- https://plugins.trac.wordpress.org/browser/booking-system-trafft/trunk/trafft.php
- https://plugins.trac.wordpress.org/browser/booking-system-trafft/trunk/trafft.php