CVE-2026-103425

Deferred Deferred - Pending Action

Stored XSS in Booking Package WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103425

EUVD

EUVD-2026-100763

Affected Vendors & Products

Vendor	Product	Version / Range
masaakitanaka	Booking	Package 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Booking Package plugin for WordPress. It exists in versions up to 1.7.29 due to insufficient input sanitization and output escaping in the 'id' parameter. Authenticated attackers with contributor-level access or higher can inject malicious scripts into pages.

Detection Guidance

Check WordPress installations for the Booking Package plugin versions up to 1.7.29. Inspect pages for injected scripts via the 'id' parameter. Use security plugins like Wordfence to scan for stored XSS vulnerabilities.

Impact Analysis

An attacker could inject scripts that execute when users visit affected pages. This may lead to theft of session cookies, account takeover, or defacement of your WordPress site. Users with contributor access or above pose the highest risk.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if exploited. Both standards require protection against unauthorized data access and breaches.

Mitigation Strategies

Update the Booking Package plugin to the latest version. Remove unauthorized scripts from pages. Restrict contributor-level access to prevent exploitation. Monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-103425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70