Booking Package <= 1.7.30 - Authenticated (Booking Package Editor+) Stored Cross-Site Scripting via Front-End JavaScript Setting
- ID
- WPSEC-2026-0942
- Plugin
- Booking Package (booking-package)
- Affected
- all versions before 1.7.31
- Remediation
- Update to 1.7.31 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-14
- Attack surface
- Booking Package on WPSec AttackSurface
- Fix released
- Published
Description
The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'updateJavaScript' mode of its admin AJAX handler in all versions up to, and including, 1.7.30, due to the mode being available to the plugin's Booking Package Editor and Manager roles and to any user with edit_others_posts rather than only to administrators, while the submitted content is written unfiltered to the plugin's front-end JavaScript file. This makes it possible for authenticated attackers with the Booking Package Editor role and above, which lack the unfiltered_html capability, to inject arbitrary JavaScript that runs for visitors of the booking calendar pages on sites with an active paid Booking Package subscription, the only case in which that file is loaded.
References
- https://wpsec.com/vuln/WPSEC-2026-0942/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.31/
- https://wordpress.org/plugins/booking-package/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS