BOOKIT · CVE-2026-125828 · Package
FIX → 2.6.0.8
BookIt, a WordPress booking plugin from Liquid Web and StellarWP, has a stored cross-site scripting flaw in versions through 2.6.0.7. An attacker who can enter data the site later displays can run scripts in visitors' browsers, including site administrators.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running the BookIt booking plugin (Liquid Web / StellarWP) at 2.6.0.7 or earlier. The CVSS vector (from Patchstack) says no privileges are needed and a user must interact, so stored input from visitors can reach scripts in admin or visitor browsers. The changelog points at the admin dashboard pages. Sites without BookIt can skip it.
Not affected if plugin-not-installed
Who cares bookit, liquid-web, stellarwp, wordpress, wordpress-plugin, xss
Upgrade to 2.6.0.8
Update BookIt to 2.6.0.8 or later (the WordPress.org changelog's 2.6.0.8 entry hardens admin dashboard pages against stored input; it does not cite the CVE id, so confirm in the Patchstack entry).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP BookIt bookit allows Stored XSS.This issue affects BookIt: from n/a through 2.6.0.7.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.