Booking Package CVE-2026-103425

Exploitation requires an authenticated WordPress account with contributor-level privileges or higher (PR:L), making open or weakly-controlled contributor registration a key enabling factor; without such an account the flaw cannot be reached. The attacker injects a payload via the plugin's 'id' parameter, and the stored script only executes when another user subsequently loads the injected page - so impact depends on a higher-privileged user (e.g., an administrator) viewing that content. The limiting factors are therefore: mandatory authentication at contributor level, reliance on a victim visiting the affected page, and the Booking Package plugin (versions ≤1.7.29) being installed and active.

This is a moderate-severity stored XSS (CVSS 6.4) whose real-world priority is tempered by its authentication requirement. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) confirms network-based, low-complexity exploitation but requires PR:L - the description specifies contributor-level access and above, so this is an authenticated vulnerability, not an unauthenticated internet-facing bug. The scope change (S:C) and C:L/I:L reflect that injected script executes in other users' browser context, potentially including higher-privileged users (e.g., an admin viewing the injected page), which is the primary escalation concern. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or widespread exploitation at this time. Overall this is a legitimate but not emergency-grade issue: it depends on an attacker already holding a contributor account, which limits its utility to insider/compromised-account scenarios or sites with open contributor registration. Patch/mitigation prioritization should sit below unauthenticated RCE or admin-takeover flaws but above purely theoretical issues.

An attacker who holds (or registers for) a contributor-level WordPress account submits content to the Booking Package plugin with a malicious payload in the 'id' parameter, which is stored without sufficient sanitization or output escaping. When an administrator or other user later views the affected page, the script executes in their browser, enabling session/cookie theft or actions performed as that higher-privileged user. No public proof-of-concept exploit is referenced in the provided data.