---
id: "CVE-2026-109147"
kind: "vulnerability"
aliases: ["CVE-2026-109147"]
title: "WP Booking System WordPress plugin: reflected XSS on admin pages"
severity: "high"
cvss: 7.1
epss: 0.00191
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-booking-system"]
not_affected_if: ["plugin-not-installed", "version-2.1.0.3-or-later"]
published_at: "2026-10-21T06:16:47+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:31:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109147", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109147", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# WP Booking System WordPress plugin: reflected XSS on admin pages

The WP Booking System WordPress plugin before 2.1.0.3 reflects one request parameter into an admin page without validation or escaping. An attacker can get a logged-in administrator to open a crafted link and run script in their session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP Booking System plugin in the WordPress admin plugins list, or with `wp plugin get wp-booking-system --field=version` (plugin slug unknown from sources)
- Treat any installed version below `2.1.0.3` as affected

## Fix

- Update the WP Booking System plugin to `2.1.0.3` or later

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109147
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109147

## From the sources

The WP Booking System  WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_