{"id":"CVE-2026-109147","kind":"vulnerability","aliases":["CVE-2026-109147"],"related":[],"title":"WP Booking System WordPress plugin: reflected XSS on admin pages","description":"The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.","summary":"The WP Booking System WordPress plugin before 2.1.0.3 reflects one request parameter into an admin page without validation or escaping. An attacker can get a logged-in administrator to open a crafted link and run script in their session.","severity":"high","cvss":7.1,"epss":0.00191,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-booking-system"],"not_affected_if":["plugin-not-installed","version-2.1.0.3-or-later"],"how_to_check":"- Check the installed version of the WP Booking System plugin in the WordPress admin plugins list, or with `wp plugin get wp-booking-system --field=version` (plugin slug unknown from sources)\n- Treat any installed version below `2.1.0.3` as affected","fix":"- Update the WP Booking System plugin to `2.1.0.3` or later","status":"open","published_at":"2026-10-21T06:16:47+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:59+00:00","updated_at":"2026-10-25T03:31:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Booking System plugin to `2.1.0.3` or later","reach":"internet","title":"WP Booking System WordPress plugin: reflected XSS on admin pages","impact":"medium","summary":"The WP Booking System WordPress plugin before 2.1.0.3 reflects one request parameter into an admin page without validation or escaping. An attacker can get a logged-in administrator to open a crafted link and run script in their session.","category":"package","nicknames":[],"who_cares":["wordpress","wp-booking-system"],"confidence":0.6,"needs_auth":"yes","worst_case":"script runs in an administrator's browser session","analyst_note":"","how_to_check":"- Check the installed version of the WP Booking System plugin in the WordPress admin plugins list, or with `wp plugin get wp-booking-system --field=version` (plugin slug unknown from sources)\n- Treat any installed version below `2.1.0.3` as affected","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.1.0.3-or-later"],"who_is_affected":"Sites running the WP Booking System plugin before `2.1.0.3`. The flaw sits in an admin page, so the exposure is highest where administrators or other privileged users are likely to click outside links while logged in. Sites without the plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3342,"output_tokens":501,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109147':13A,16A '-2026':12A,15A '2.1.0.3':30B,70C 'admin':9A,37B,86C 'administr':51B,105C 'attack':44B 'back':83C 'book':2A,21B,25B,65C 'could':96C 'craft':55B 'cross':92C 'cross-sit':91C 'cve':11A,14A 'escap':42B,75C 'get':46B 'high':100C 'lead':88C 'link':56B 'log':49B 'logged-in':48B 'one':32B,76C 'open':53B 'packag':17B 'page':10A,38B,87C 'paramet':34B,79C 'plugin':5A,28B,68C 'privileg':101C 'reflect':6A,31B,81C,90C 'request':33B 'run':58B 'script':59B,94C 'session':62B 'site':93C 'system':3A,22B,26B,66C 'use':98C 'user':102C 'valid':40B,73C 'without':39B 'wordpress':4A,18B,27B,67C 'wp':1A,20B,24B,64C 'wp-booking-system':19B 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Booking System plugin before `2.1.0.3`. The flaw sits in an admin page, so the exposure is highest where administrators or other privileged users are likely to click outside links while logged in. Sites without the plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109147","severity":null,"published_at":"2026-10-21T06:16:47+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109147","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109147","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}