Booking and Rental Manager CVE-2026-85303

Exploitation requires the attacker to hold at least a low-privileged authenticated account on the WordPress site (PR:L per CVSS vector) - for example, a registered WooCommerce customer account, which many booking sites allow open self-registration for. A higher-privileged victim (such as a WordPress administrator or editor) must then view or interact with the page that renders the stored payload (UI:R), typically the booking management or review interface in the WordPress admin panel. Exploitation is limited to sites with the Booking and Rental Manager plugin installed and active through version 2.7.7. No additional non-default WordPress configuration is described as required. The primary limiting factors are: mandatory attacker authentication (no unauthenticated path), required victim interaction, and the niche deployment footprint of the plugin.

The vendor CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) places this in the medium-severity band, accurately capturing several meaningful constraints. PR:L confirms that injection requires at minimum a registered, authenticated account, ruling out fully unauthenticated exploitation. UI:R means a victim must actively view the page containing the stored payload, introducing a necessary social or workflow dependency. The S:C scope change does materially elevate real-world risk: if an administrator is the victim, the effective impact escalates toward full WordPress site compromise through admin session hijacking. The A:L (availability impact low) metric in the vendor vector is atypical for a standard stored XSS and is likely overstated unless the injected script provably causes resource exhaustion or page dysfunction - this is not described in available data. No EPSS score is provided; with no KEV listing and no known public exploit, the near-term exploitation probability is assessed as low-to-moderate depending on the site's user registration exposure.

An attacker registers a low-privileged account on a WooCommerce site running the vulnerable plugin, then submits a booking request containing a crafted JavaScript payload (e.g., a cookie-stealing script) in an unsanitized field such as a booking note or rental detail. When a site administrator reviews the pending booking in the WordPress dashboard, the stored script silently executes in their browser, exfiltrating their session token to an attacker-controlled endpoint and enabling full administrative account takeover. No public exploit code has been identified at time of analysis.