BA Book Everything <= 1.8.33 - Unauthenticated Reflected Cross-Site Scripting via 'action_update' Parameter
- ID
- WPSEC-2026-1927
- Plugin
- BA Book Everything (ba-book-everything)
- Affected
- all versions before 1.8.34
- Remediation
- Update to 1.8.34 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- BA Book Everything on WPSec AttackSurface
- Fix released
- Published
Description
The BA Book Everything plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action_update' parameter of the admin and customer order confirmation pages in all versions up to, and including, 1.8.33. This is due to insufficient input validation and output escaping, combined with order validation that used loose comparisons and did not check that the supplied ID was an order or that the order number and hash were non-empty. As a result, a link with an empty order number and hash passes validation. On sites that use manual availability confirmation, this makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user, such as an administrator, into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-1927/
- https://plugins.svn.wordpress.org/ba-book-everything/tags/1.8.34/
- https://wordpress.org/plugins/ba-book-everything/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS