EUVD-2026-70558
GHSA-29gh-g3h8-vv2x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Standard stored XSS with scope change; A:N because XSS does not inherently impact availability, and no such mechanism is described in the vulnerability data.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS.
This issue affects Booking and Rental Manager: from n/a through 2.7.7.
AnalysisAI
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at least a low-privileged authenticated account on the WordPress site (PR:L per CVSS vector) - for example, a registered WooCommerce customer account, which many booking sites allow open self-registration for. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) places this in the medium-severity band, accurately capturing several meaningful constraints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for a patched release beyond 2.7.7; a fixed version is expected but not explicitly confirmed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Booking And Rental Manager
View allPHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attacker
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level aut
The Booking and Rental Manager plugin for WordPress through version 2.6.0 contains an authorization bypass that allows a
Missing authorization in the Booking and Rental Manager WordPress plugin (≤ 2.6.9) exposes unauthenticated remote attack
Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) perm
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today