Live › vulnerability › CVE-2026-109147
Go to dashboardThe WP Booking System WordPress plugin before 2.1.0.3 reflects one request parameter into an admin page without validation or escaping. An attacker can get a logged-in administrator to open a crafted link and run script in their session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WP Booking System plugin before . The flaw sits in an admin page, so the exposure is highest where administrators or other privileged users are likely to click outside links while logged in. Sites without the plugin installed can skip it.
2.1.0.3No product ranges from the sources yet.
wp plugin get wp-booking-system --field=version (plugin slug unknown from sources)2.1.0.3 as affected2.1.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-109147")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.