{"id":"CVE-2026-125828","kind":"vulnerability","aliases":["CVE-2026-125828"],"related":[],"title":"BookIt WordPress plugin: stored XSS through 2.6.0.7 lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP BookIt bookit allows Stored XSS.This issue affects BookIt: from n/a through 2.6.0.7.","summary":"BookIt, a WordPress booking plugin from Liquid Web and StellarWP, has a stored cross-site scripting flaw in versions through 2.6.0.7. An attacker who can enter data the site later displays can run scripts in visitors' browsers, including site administrators.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bookit","fixed":["2.6.0.8"],"affected":"<= 2.6.0.7","ecosystem":"wordpress"}],"ecosystems":[],"tags":["bookit","liquid-web","package","stellarwp","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: BookIt version 2.6.0.7 or lower is in range.\n- Or read the Version header in wp-content/plugins/bookit/bookit.php.","fix":"Update BookIt to 2.6.0.8 or later (the WordPress.org changelog's 2.6.0.8 entry hardens admin dashboard pages against stored input; it does not cite the CVE id, so confirm in the Patchstack entry).","status":"open","published_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:23+00:00","updated_at":"2026-11-15T14:39:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T14:37:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BookIt WordPress plugin: stored XSS through 2.6.0.7 lets attackers run scripts","impact":"medium","summary":"BookIt, a WordPress booking plugin from Liquid Web and StellarWP, has a stored cross-site scripting flaw in versions through 2.6.0.7. An attacker who can enter data the site later displays can run scripts in visitors' browsers, including site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bookit","liquid-web","stellarwp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker scripts run in admin browsers, hijacking sessions","analyst_note":"Confirm the fixed version and the required privilege from the NVD entry or the vendor advisory for BookIt (Liquid Web / StellarWP).","how_to_check":"- Check the installed BookIt plugin version in the WordPress admin under Plugins.\n- Look for the `bookit` plugin directory and its version header in `wp-content/plugins/bookit/`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the BookIt WordPress plugin at version 2.6.0.7 or earlier. The sources do not say which input fields are exposed or whether a logged-in user is needed to store the payload, so sites running the plugin should treat it as exposed until they confirm otherwise.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4549,"output_tokens":587,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the required privilege from the NVD entry or the vendor advisory for BookIt (Liquid Web / StellarWP).","search":"'-125828':14A,17A '-2026':13A,16A '2.6.0.7':7A,51B,99C 'administr':70B 'affect':94C 'allow':90C 'attack':9A,53B 'book':33B 'bookit':1A,18A,19B,30B,88C,89C,95C 'browser':67B 'cross':44B,80C 'cross-sit':43B,79C 'cve':12A,15A 'data':57B 'display':61B 'enter':56B 'flaw':47B 'generat':78C 'improp':71C 'includ':68B 'input':74C 'issu':93C 'later':60B 'let':8A 'liquid':21B,36B,85C 'liquid-web':20B 'n/a':97C 'neutral':72C 'packag':23B 'page':77C 'plugin':3A,28B,34B 'run':10A,63B 'script':11A,46B,64B,82C 'site':45B,59B,69B,81C 'stellarwp':24B,39B,87C 'store':4A,42B,91C 'version':49B 'visitor':66B 'vulner':83C 'web':22B,37B,76C,86C 'wordpress':2A,25B,27B,32B 'wordpress-plugin':26B 'xss':5A,29B 'xss.this':92C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the BookIt booking plugin (Liquid Web / StellarWP) at 2.6.0.7 or earlier. The CVSS vector (from Patchstack) says no privileges are needed and a user must interact, so stored input from visitors can reach scripts in admin or visitor browsers. The changelog points at the admin dashboard pages. Sites without BookIt can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["bookit"],"ptokens":["bookit"],"labels":["bookit","high","liquidweb","package","stellarwp","wordpress","wordpressplugin","xss"],"campaign_type":null,"search_a":"'-125828':14A,17A '-2026':13A,16A '2.6.0.7':7A 'attack':9A 'bookit':1A,18A 'cve':12A,15A 'let':8A 'plugin':3A 'run':10A 'script':11A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'2.6.0.7':51B 'administr':70B 'attack':53B 'book':33B 'bookit':19B,30B 'browser':67B 'cross':44B 'cross-sit':43B 'data':57B 'display':61B 'enter':56B 'flaw':47B 'includ':68B 'later':60B 'liquid':21B,36B 'liquid-web':20B 'packag':23B 'plugin':28B,34B 'run':63B 'script':46B,64B 'site':45B,59B,69B 'stellarwp':24B,39B 'store':42B 'version':49B 'visitor':66B 'web':22B,37B 'wordpress':25B,27B,32B 'wordpress-plugin':26B 'xss':29B","search_c":"'2.6.0.7':99C 'affect':94C 'allow':90C 'bookit':88C,89C,95C 'cross':80C 'cross-sit':79C 'generat':78C 'improp':71C 'input':74C 'issu':93C 'liquid':85C 'n/a':97C 'neutral':72C 'page':77C 'script':82C 'site':81C 'stellarwp':87C 'store':91C 'vulner':83C 'web':76C,86C 'xss.this':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125828","severity":null,"published_at":"2026-11-15T14:17:25+00:00","modified_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125828:4044","url":"https://wordpress.org/plugins/bookit/","severity":null,"published_at":"2026-11-15T14:39:16+00:00","modified_at":"2026-11-15T14:39:16+00:00","first_seen_at":"2026-11-15T14:39:16+00:00","fetched_at":"2026-11-15T14:39:16+00:00","note":"NVD/Patchstack: stored XSS <= 2.6.0.7, CVSS 7.1 vector PR:N UI:R S:C. WordPress.org changelog lists 2.6.0.8 (2026-11-12) 'Hardened the admin dashboard pages against stored input' - likely the fix but it does not name the CVE, so not marked verified.","cites":["https://wordpress.org/plugins/bookit/","https://nvd.nist.gov/vuln/detail/CVE-2026-125828"]}],"documents":[{"id":39713,"url":"https://wordpress.org/plugins/bookit/","title":"Bookit plugin page and changelog (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":163843,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125828","title":"NVD CVE-2026-125828","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}