Booking Calendar CVE-2026-93655

Exploitation requires an attacker to deliver a crafted link containing a malicious payload in the 'wpbc_auto_fill' parameter to a page rendered by the Booking Calendar plugin (wpdevelop) on WordPress, versions up to and including 11.8.3, and requires the victim to click that link (UI:R). No authentication is needed by the attacker (PR:N). Limiting factors: the reflected (non-persistent) nature means each victim must be individually social-engineered into clicking; there is no server-side compromise, and impact is confined to script execution in the victim's browser within the site origin. Requires the affected plugin to be installed and the vulnerable page/endpoint reachable.

This is a reflected cross-site scripting flaw (CWE-79) with a vendor CVSS 3.1 score of 6.1 (Medium) via the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The unauthenticated network vector and low complexity raise its reach, but exploitation is fundamentally gated by UI:R - a victim must be tricked into clicking a crafted link, and the payload only reflects (it does not persist), so there is no mass-exploitation primitive. Reported by Wordfence, a credible source for WordPress plugin issues. No EPSS probability, no CISA KEV listing, and no public POC are present in the provided data - meaning there is no signal of active or automatable exploitation; per precision rules this is 'no public exploit identified at time of analysis.' The confidentiality/integrity impacts are Low and the scope-change (S:C) reflects the classic browser-context escape typical of XSS rather than server compromise. Net: this is a real but modest-priority issue - a Medium-severity reflected XSS in a widely-installed plugin that is worth patching promptly but does not warrant emergency response absent exploitation signals. No key signals conflict; the description (unauthenticated, click-to-trigger) is consistent with the CVSS vector.

An attacker crafts a URL to a vulnerable Booking Calendar page with a malicious script payload in the 'wpbc_auto_fill' parameter and distributes it via phishing email, forum post, or social media. When a logged-in administrator or site visitor clicks the link, the unsanitized parameter is reflected into the page and the script executes in their browser session in the site's origin. No public POC or exploit code is identified in the provided data.