Booking Calendar CVE-2026-92561

Exploitation requires an unauthenticated attacker to deliver a crafted link (UI:R - the victim must click it) targeting the 'options' parameter of the plugin's front-end AJAX endpoint. The critical enabling condition is default: the 'booking_is_nonce_at_front_end' option ships DISABLED, so the nonce verification that would otherwise block unauthenticated requests is bypassed out-of-the-box, meaning default installations of Booking Calendar <=11.8.2 are exploitable. The primary LIMITING factor is the required user interaction (a phished click) and the reflected (non-persistent) nature - payloads are not stored, so each victim must be individually lured. Sites that have manually enabled the front-end nonce option raise the bar by reinstating nonce verification.

This is a reflected cross-site scripting flaw with a moderate real-world risk profile. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) indicates network-reachable, low-complexity exploitation requiring no privileges but hinging on user interaction (UI:R) - the victim must click an attacker-crafted link. Exploitation status: no public exploit identified at time of analysis (no KEV listing, no EPSS score provided, no POC referenced in the sources). No SSVC decision data was supplied. The signal that elevates this above a routine reflected-XSS finding is in the description: the nonce check that would normally gate the vulnerable AJAX sink is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, so unauthenticated requests reach the sink out-of-the-box - meaning the default configuration is the vulnerable configuration. Reflected XSS is not wormable and still depends on social engineering, so this is a genuine-but-not-critical priority: patch in a normal cycle, prioritized upward for internet-facing sites with authenticated admin users who could be phished. No conflicting signals were found; the CVSS vector and description are mutually consistent.

An unauthenticated attacker crafts a URL to a target WordPress site's Booking Calendar AJAX endpoint with a malicious payload in the 'options' parameter and lures a logged-in administrator (or any user) into clicking it. Because the front-end nonce option is disabled by default, the request reaches the vulnerable sink without verification, the payload is reflected unescaped into the response, and the injected script executes in the victim's browser session. No public POC is referenced, but the affected code lines are pinpointed in the plugin source, lowering the barrier to weaponization.