WP Booking System CVE-2026-57639

Exploitation requires user interaction (CVSS UI:R): a logged-in WordPress user - most impactfully an administrator - must click an attacker-crafted link that reflects an unsanitized input parameter into the WP Booking System plugin's generated page. No authentication is required of the attacker (PR:N), but the attack fails without a victim who both has an active WordPress session and follows the malicious link, which limits realistic impact to social-engineering-driven, targeted scenarios rather than unattended remote compromise. The specific vulnerable parameter or feature is not described in the available sources beyond the reflected-XSS classification and the affected version range (n/a through 2.1.0.6).

This is a moderate-severity reflected XSS (CWE-79) in the WP Booking System WordPress plugin, scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector with no privileges required (PR:N) means an unauthenticated attacker can target victims remotely, but the UI:R requirement is the dominant limiting factor: exploitation depends entirely on tricking an authenticated user - typically a site administrator - into clicking a crafted link, so this is not a wormable or automatable mass-exploitation primitive. The vuln.today decision label is 'this_week' rather than act_now or emergency, consistent with a single-vendor-advisory finding that warrants scheduled patching, not an incident response. There is no CISA KEV listing and no EPSS score was supplied in the input, so there is no signal of active or probable exploitation; the only source is a Patchstack database advisory (reported by Patchstack). Signals are internally consistent - a genuine but UI-gated client-side flaw - making this a real but non-urgent priority rather than a high-CVSS-but-low-real-risk artifact. The scope change (S:C) reflects script execution in the victim's browser context against the WordPress session, which is the main avenue to escalation (e.g., stealing an admin session or performing admin actions via the victim's browser).

An attacker crafts a malicious URL targeting the vulnerable WP Booking System parameter and lures an authenticated WordPress user (ideally an administrator) into clicking it, for example via a phishing email or a comment link. When the victim loads the link, attacker-controlled script reflects into the page and executes in the victim's browser under the site's origin, allowing session-context actions such as cookie/session theft or admin operations. No public exploit was identified at time of analysis; only a Patchstack advisory reference is available.