WP Booking System – Booking Calendar <= 2.1.0.8 - Unauthenticated Reflected Cross-Site Scripting via Booking Form Hidden Fields
- ID
- WPSEC-2026-2930
- Plugin
- WP Booking System – Booking Calendar (wp-booking-system)
- Affected
- from 2.1 before 2.1.0.9
- Remediation
- Update to 2.1.0.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-12
- Attack surface
- WP Booking System – Booking Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbs-upload-token', 'wpbs-return-url' and 'wpbs-post-id' values of the 'form_data' POST parameter in all versions up to, and including, 2.1.0.8. The booking form reads these values from the request and only passes them through sanitize_text_field(), which does not remove double quotes, before writing them into the value attributes of the form's hidden inputs without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a page that shows the booking form. The scripts run if the attacker can trick a user into performing an action such as submitting a crafted form.
References
- https://wpsec.com/vuln/WPSEC-2026-2930/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.9/
- https://wordpress.org/plugins/wp-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS