CVE-2026-107126

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in WP Booking System WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107126

EUVD

EUVD-2026-100886

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WP	Booking System 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated stored Cross-Site Scripting (XSS) flaw in the WP Booking System WordPress plugin before version 2.1.0.1. It occurs because the plugin does not properly sanitize and escape user-controlled input from the X-Forwarded-For header before storing it. When an administrator views the stored data, the injected malicious script executes in their session.

Detection Guidance

Check if the WP Booking System plugin version is below 2.1.0.1. Inspect server logs for unusual X-Forwarded-For header values or admin screen entries containing scripts. Use WPScan to detect vulnerable versions.

Impact Analysis

An attacker could exploit this to inject malicious scripts into the plugin's admin interface. If an administrator views the affected data, the script runs with their privileges, potentially leading to session hijacking, data theft, or unauthorized actions on the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR or HIPAA requirements for data protection and security. Organizations using the vulnerable plugin may face compliance violations and potential penalties.

Mitigation Strategies

Update the WP Booking System plugin to version 2.1.0.1 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Hi! I’m here to help you understand CVE-2026-107126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70