CVE-2026-109147
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its…
- Risk score
- 49/100
- CVSS
- 7.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
- Affected
- See advisory
- Fix
- Upgrade the product to 2.1.0.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
- Remotely exploitable without logging in
References
Original description
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Last activity 21 Oct 2026. Patch Forecast updates every hour.