CVE-2026-57639 · Package
NO FIX YET · SEE WHAT TO DO
The WP Booking System WordPress plugin by Roland Murg does not neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can run scripts in a visitor's browser by tricking them into opening a crafted link.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Websites running the WP Booking System WordPress plugin up to and including version 2.1.0.6 are exposed. Exploitation requires a visitor to open a crafted link, so the risk is mainly to logged-in administrators and site visitors. Sites without the plugin installed are not affected.
Not affected if patched-version, plugin-not-installed
Who cares wordpress, wp-booking-system
Version header in wp-content/plugins/wp-booking-system/ plugin main file.2.1.0.6.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-57639") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.