EUVD-2026-91203
GHSA-cfgg-mx22-mvjv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Injection is unauthenticated and remote (AV:N/AC:L/PR:N), but execution requires a privileged user to open the order record, so UI:R; XSS runs in the admin browser context giving S:C with C:L/I:L/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator or other privileged user opens the injected order record in the plugin's wp-admin order management area, which is the plugin's ordinary order-review workflow.
AnalysisAI
Stored cross-site scripting in the BA Book Everything plugin for WordPress (all versions up to and including 1.8.28) lets unauthenticated attackers inject arbitrary JavaScript through the 'booking_service_qty' parameter of a public booking submission, which is saved inside the resulting order record. The payload is later emitted without escaping in the plugin's wp-admin order management screens, so it executes in the browser of an administrator or other privileged user the moment that order is opened - the plugin's ordinary order-review workflow - giving a scope-changing (S:C) impact despite the injection itself needing no authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Injection is unauthenticated against the plugin's public booking submission, placing attacker data into the 'booking_service_qty' parameter of an order record. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, framing this as a network-reachable, unauthenticated, no-interaction stored XSS with a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | An upstream fix is available in the WordPress plugin repository changeset (new=3720938, old=3709590 for ba-book-everything), but a released patched plugin version has not been independently confirmed at time of analysis - no vendor-released patch version number is identified in the source data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable the BA Book Everything plugin on all WordPress instances, as no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis; if disabling is not immediately feasible, restrict access to wp-admin order management screens to trusted IPs, enforce multi-factor authentication for all administrative users, and deploy a web application firewall rule to sanitize the 'booking_service_qty' parameter on public booking submissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ba Book Everything
View allThe BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booking Algorithms
Stored cross-site scripting in the BA Book Everything WordPress plugin affects every version up to and including 1.8.27:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bookingalgorithms
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' sh
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms
The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and includi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today