WP Booking System CVE-2026-109147

Exploitation requires an authenticated, high-privilege user (administrator) to be tricked into loading an attacker-crafted URL targeting the vulnerable admin page - this is the parameter the plugin reflects without validation or escaping (UI:R in the CVSS vector). The attacker needs no credentials or prior access to construct the payload (PR:N), and no special plugin configuration beyond having WP Booking System before 2.1.0.3 installed and active. The primary limiting factors are: (1) a victim administrator must actively click the malicious link, so the attack depends on successful social engineering/phishing; (2) the payload fires only in the targeted admin's browser session, not server-side; and (3) sites already upgraded to 2.1.0.3 or later are not affected.

This is a moderate-severity Reflected Cross-Site Scripting flaw (CVSS 7.1) in the WP Booking System WordPress plugin before 2.1.0.3. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation with no attacker privileges required, but the critical limiting factor is UI:R - a victim (specifically a high-privilege administrator) must click or load an attacker-crafted link. The scope-changed metric (S:C) correctly reflects that the injected script executes in the admin's browser context rather than the plugin's own security context. A public exploit exists (WPScan) and a vendor patch is available, which raises operational urgency, but EPSS and SSVC data were NOT provided in the input, and the vulnerability is NOT listed in CISA KEV - so there is no confirmed active exploitation. The PR:N rating is technically accurate because the attacker needs no credentials to craft the payload, yet real-world risk is tempered by the requirement that an administrator must be socially engineered into triggering the reflected request. Net assessment: a credible, patchable priority for sites running this plugin given the public PoC, but not a mass-exploitation emergency - it should be treated as a targeted, phishing-dependent threat rather than a wormable remote-code issue.

An attacker crafts a malicious URL for the vulnerable WP Booking System admin page with a payload in the unvalidated, unescaped parameter, then phishes a logged-in administrator into clicking it. When the admin loads the page, the reflected script executes in their authenticated browser session, enabling actions such as creating rogue admin accounts or stealing session data. A public exploit is available via WPScan, and the low attack complexity (AC:L) means crafting the payload is trivial - the main hurdle is the required administrator interaction (UI:R).