{"id":"CVE-2026-39786","kind":"vulnerability","aliases":["CVE-2026-39786"],"related":[],"title":"BA Book Everything WordPress plugin: unauthenticated XSS through 1.8.33","description":"Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.","summary":"BA Book Everything, a WordPress booking plugin, has a cross-site scripting flaw reachable without logging in, in versions up to and including 1.8.33. An attacker can make a visitor's browser run injected script on the affected site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ba-book-everything","fixed":["1.8.34"],"affected":"<= 1.8.33","ecosystem":"wordpress"}],"ecosystems":[],"tags":["ba-book-everything","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Plugins page in WordPress admin: BA Book Everything version must be 1.8.34 or higher; or read the Version header in wp-content/plugins/ba-book-everything/ba-book-everything.php. Versions <= 1.8.33 are affected.","fix":"Update BA Book Everything to 1.8.34 or later (changelog: XSS fix in the manual order confirmation process, reported by patchstack).","status":"open","published_at":"2026-10-30T19:18:24+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:26:06+00:00","updated_at":"2026-10-30T19:29:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:26:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BA Book Everything WordPress plugin: unauthenticated XSS through 1.8.33","impact":"medium","summary":"BA Book Everything, a WordPress booking plugin, has a cross-site scripting flaw reachable without logging in, in versions up to and including 1.8.33. An attacker can make a visitor's browser run injected script on the affected site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ba-book-everything"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"visitor's browser runs attacker script on the site","analyst_note":"Find the vulnerable endpoint and a fixed plugin version; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-39786 and the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/ba-book-everything/`.\n- Confirm whether the site runs BA Book Everything at all.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Websites running the BA Book Everything WordPress plugin at version 1.8.33 or older are exposed, since the flaw needs no login. Sites without this plugin are not affected. The sources do not say which page or input is the injection point.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4068,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vulnerable endpoint and a fixed plugin version; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-39786 and the plugin's changelog.","search":"'-2026':11A,14A '-39786':12A,15A '1.8.33':9A,50B,75C 'affect':64B 'attack':52B 'ba':1A,17A,21B,26B,72C 'ba-book-everyth':20B 'ba-book-everything':16A 'book':2A,18A,22B,27B,31B,73C 'browser':58B 'cross':36B,67C 'cross-sit':35B 'cve':10A,13A 'everyth':3A,23B,28B,74C 'everything':19A 'flaw':39B 'includ':49B 'inject':60B 'log':42B 'make':54B 'packag':24B 'plugin':5A,32B 'reachabl':40B 'run':59B 'script':38B,61B,69C 'site':37B,65B,68C 'unauthent':6A,66C 'version':45B,76C 'visitor':56B 'without':41B 'wordpress':4A,25B,30B 'xss':7A,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the BA Book Everything WordPress plugin at 1.8.33 or older are exposed; no login is needed but a visitor or admin must be lured into an action (UI:R). The changelog points to the manual order confirmation flow as the fixed XSS, which probably is this issue, though it does not cite the CVE. Sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39786","severity":null,"published_at":"2026-10-30T19:18:24+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-39786:1195","url":null,"severity":null,"published_at":"2026-10-30T19:29:46+00:00","modified_at":"2026-10-30T19:29:46+00:00","first_seen_at":"2026-10-30T19:29:46+00:00","fetched_at":"2026-10-30T19:29:46+00:00","note":"NVD gives only 'unauth XSS <=1.8.33' (CVSS 7.1, Patchstack). WordPress.org changelog 1.8.34 'fixed XSS in manual order confirmation, reported by patchstack' is the likely fix, but it does not name the CVE, so nothing marked verified. No exploitation or PoC found; endpoint not confirmed. Same plugin had sibling unauth stored XSS fixes in 1.8.27/1.8.28."}],"documents":[{"id":25509,"url":"https://wordpress.org/plugins/ba-book-everything/","title":"BA Book Everything - WordPress.org changelog (1.8.34)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":25510,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39786","title":"NVD CVE-2026-39786","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}