What is the CVSS score of CVE-2026-28040?

CVE-2026-28040 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Taxi Booking Manager for WooCommerce CVE-2026-28040

EUVD-2026-25217 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-23 Patchstack

GHSA-cr8r-qr27-mm7q

WordPress XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 23, 2026 - 12:00 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 11:30 euvd

EUVD-2026-25217

Analysis Generated

Apr 23, 2026 - 11:30 vuln.today

CVE Published

Apr 23, 2026 - 11:00 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.0.

AnalysisAI

Stored cross-site scripting (XSS) in Magepeople's Taxi Booking Manager for WooCommerce plugin (versions up to 2.0.0) allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of the application. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

This is a CWE-79 improper neutralization of input during web page generation vulnerability, classified as stored XSS. The Taxi Booking Manager for WooCommerce plugin fails to properly sanitize and escape user-supplied input before rendering it in web pages. The plugin's WordPress integration (as indicated by the CPE and tags) means the vulnerability exists within a plugin architecture where user inputs may be stored in the database and later rendered to other users without adequate output encoding. Stored XSS vulnerabilities are particularly dangerous because the malicious payload persists and affects all users viewing the compromised content, not just the attacker.

RemediationAI

Upgrade the Taxi Booking Manager for WooCommerce plugin to a version newer than 2.0.0. Magepeople has released a patched version addressing this stored XSS vulnerability; check the official WordPress plugin repository or Magepeople's website for the latest available version and apply the update immediately. Until a patch can be applied, implement strict WordPress user role management by restricting plugin access to trusted administrators only, disable the specific features of the plugin that accept user input if they are not immediately required, and apply a Web Application Firewall (WAF) rule to filter common XSS payloads in HTTP requests to the plugin's endpoints. Additionally, audit all existing data in the database for stored XSS payloads and remove any suspicious content. Note that WAF filtering is not a complete solution as determined attackers may bypass patterns, so patching remains the primary remediation.