Live › vulnerability › CVE-2026-39786
BA Book Everything, a WordPress booking plugin, has a cross-site scripting flaw reachable without logging in, in versions up to and including 1.8.33. An attacker can make a visitor's browser run injected script on the affected site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the BA Book Everything WordPress plugin at 1.8.33 or older are exposed; no login is needed but a visitor or admin must be lured into an action (UI:R). The changelog points to the manual order confirmation flow as the fixed XSS, which probably is this issue, though it does not cite the CVE. Sites without the plugin are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ba-book-everything | wordpress | <= 1.8.33 | 1.8.34 |
1.8.34 or higher; or read the Version header in wp-content/plugins/ba-book-everything/ba-book-everything.php1.8.33 are affectedUpdate BA Book Everything to 1.8.34 or later (changelog: XSS fix in the manual order confirmation process, reported by patchstack).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-39786")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.