{
 "id": "WPSEC-2026-1927",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1927/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1927/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1927/index.md",
 "title": "BA Book Everything <= 1.8.33 - Unauthenticated Reflected Cross-Site Scripting via 'action_update' Parameter",
 "description": "The BA Book Everything plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action_update' parameter of the admin and customer order confirmation pages in all versions up to, and including, 1.8.33. This is due to insufficient input validation and output escaping, combined with order validation that used loose comparisons and did not check that the supplied ID was an order or that the order number and hash were non-empty. As a result, a link with an empty order number and hash passes validation. On sites that use manual availability confirmation, this makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user, such as an administrator, into clicking a crafted link.",
 "plugin": {
  "slug": "ba-book-everything",
  "name": "BA Book Everything",
  "full_name": "BA Book Everything",
  "wordpress_org": "https://wordpress.org/plugins/ba-book-everything/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ba-book-everything/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ba-book-everything"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.34",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.34"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.34",
 "remediation": "Update to 1.8.34 or later.",
 "fix_released": "2026-10-28T10:26:18+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:43:16.638735+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1927/",
  "https://plugins.svn.wordpress.org/ba-book-everything/tags/1.8.34/",
  "https://wordpress.org/plugins/ba-book-everything/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ba-book-everything",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}