---
id: "CVE-2026-39786"
kind: "vulnerability"
aliases: ["CVE-2026-39786"]
title: "BA Book Everything WordPress plugin: unauthenticated XSS through 1.8.33"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ba-book-everything", "fixed": ["1.8.34"], "affected": "<= 1.8.33", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["ba-book-everything", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-30T19:18:24+00:00"
first_seen_at: "2026-10-30T19:25:29+00:00"
updated_at: "2026-10-30T19:29:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39786", "first_seen_at": "2026-10-30T19:25:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:29:46+00:00"}]
---

# BA Book Everything WordPress plugin: unauthenticated XSS through 1.8.33

BA Book Everything, a WordPress booking plugin, has a cross-site scripting flaw reachable without logging in, in versions up to and including 1.8.33. An attacker can make a visitor's browser run injected script on the affected site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ba-book-everything affected <= 1.8.33 fixed 1.8.34

## How to check

Plugins page in WordPress admin: BA Book Everything version must be 1.8.34 or higher; or read the Version header in wp-content/plugins/ba-book-everything/ba-book-everything.php. Versions <= 1.8.33 are affected.

## Fix

Update BA Book Everything to 1.8.34 or later (changelog: XSS fix in the manual order confirmation process, reported by patchstack).

## Timeline

- 2026-10-30T19:25:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39786
- 2026-10-30T19:29:46+00:00 analyst — NVD gives only 'unauth XSS <=1.8.33' (CVSS 7.1, Patchstack). WordPress.org changelog 1.8.34 'fixed XSS in manual order confirmation, reported by patchstack' is the likely fix, but it does not name the CVE, so nothing marked verified. No exploitation or PoC found; endpoint not confirmed. Same plugin had sibling unauth stored XSS fixes in 1.8.27/1.8.28.

## Documents

- [advisory] NVD CVE-2026-39786 https://nvd.nist.gov/vuln/detail/CVE-2026-39786
- [fix] BA Book Everything - WordPress.org changelog (1.8.34) https://wordpress.org/plugins/ba-book-everything/

## From the sources

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_