# Booking Package <= 1.7.30 - Authenticated (Booking Package Editor+) Stored Cross-Site Scripting via Front-End JavaScript Setting

- **ID:** WPSEC-2026-0942
- **Plugin:** Booking Package (`booking-package`), https://wordpress.org/plugins/booking-package/
- **Affected versions:** all versions before 1.7.31
- **Fixed in:** 1.7.31 (Update to 1.7.31 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-package
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0942/

## Description

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'updateJavaScript' mode of its admin AJAX handler in all versions up to, and including, 1.7.30, due to the mode being available to the plugin's Booking Package Editor and Manager roles and to any user with edit_others_posts rather than only to administrators, while the submitted content is written unfiltered to the plugin's front-end JavaScript file. This makes it possible for authenticated attackers with the Booking Package Editor role and above, which lack the unfiltered_html capability, to inject arbitrary JavaScript that runs for visitors of the booking calendar pages on sites with an active paid Booking Package subscription, the only case in which that file is loaded.

## References

- https://wpsec.com/vuln/WPSEC-2026-0942/
- https://plugins.svn.wordpress.org/booking-package/tags/1.7.31/
- https://wordpress.org/plugins/booking-package/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0942/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.