EUVD-2026-42528
GHSA-vvcw-jcq9-759q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects mandatory contributor access; UI:R corrects the provided vector since a victim must visit the page for stored XSS to execute.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Bookero.pl - system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookero_products shortcode's hide_products (and filter_products) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the bookero_products() function - the raw attribute value is concatenated directly into an inline <script> block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.
AnalysisAI
Stored Cross-Site Scripting in the Bookero.pl WordPress booking plugin (versions up to and including 2.2) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the bookero_products shortcode. The bookero_products() function in libraries/bookero-front.php (lines 173-174) concatenates the raw hide_products and filter_products attribute values directly into an inline <script> block with no sanitization or output escaping, meaning any page rendered with the poisoned shortcode will execute the attacker-supplied script in every visitor's browser. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The affected product is the Bookero.pl - system rezerwacji online WordPress plugin by Safistudio (CPE: cpe:2.3:a:safistudio:bookero.pl_-_system_rezerwacji_online:*:*:*:*:*:*:*:*), a Polish-language online reservation/booking system. The vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored/persistent variant. The technical root cause is unsanitized attribute injection into a server-rendered inline <script> block: when the [bookero_products] shortcode is processed, the value of hide_products or filter_products is inserted as a raw string into JavaScript code that the server embeds in the HTML page, bypassing WordPress's standard output escaping functions like esc_js() or wp_json_encode(). Because the injected payload is stored in a post or page rather than reflected from a URL parameter, every subsequent page load re-executes the payload. The CVSS Scope metric is Changed (S:C) because the injected script executes in the victim's browser security context, crossing from the WordPress application boundary into the user's browser domain.
RemediationAI
A fix has been committed to the WordPress plugin SVN repository as changeset 3524452 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3524452%40bookeropl&new=3524452%40bookeropl); however, an exact released patched version number is not independently confirmed from the available data - administrators should update to the latest available version in the WordPress Plugin Directory and verify the installed version is newer than 2.2. As a compensating control pending upgrade, administrators should revoke contributor-level access for any untrusted users and audit existing posts and pages for [bookero_products] shortcodes with unexpected attribute values. Restricting shortcode usage to editor-level or above via a capability management plugin (e.g., Members or User Role Editor) would limit the attack surface with minimal operational disruption. Removing the plugin entirely until patched is the most conservative option if the booking feature is non-critical.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today