EUVD-2026-86546
GHSA-r85w-gp72-g77q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network attacker self-generates the order tokens via the public booking form (PR:N/AC:L); stored XSS crosses into the victim browser (S:C) with limited C:L/I:L and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the BA Book Everything WordPress plugin affects every version up to and including 1.8.27: the first_name field submitted through the public [babe-booking-form] booking flow is neither sanitized on input nor escaped on output, so a payload persists and executes in the browser of any user who later views the affected order or payment page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) indicates the injection step requires no authentication - an attacker can create a guest booking through the shortcode, harvest the returned order_id, order_num and order_hash, and then reach the action_to_pay() handler with a malicious first_name value. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or user account required to inject: the attacker triggers the flaw by placing a guest booking through the public [babe-booking-form] shortcode (which must be present on the site) and using the returned order_id/order_num/order_hash to reach the action_to_pay() handler with an unsanitized first_name value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress.org Trac changeset https://plugins.trac.wordpress.org/changeset?reponame=&new=3709588%40ba-book-everything%2Ftrunk&old=3640320%40ba-book-everything%2Ftrunk shows the corrective change landing in trunk, so the primary action is to update BA Book Everything to the first tagged release after 1.8.27 as soon as it appears and to verify the installed version through the WordPress Plugins screen or WP-CLI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress sites running BA Book Everything at version 1.8.27 or earlier and confirm whether the [babe-booking-form] shortcode is published on any publicly reachable page; for any site where it is, deactivate the plugin immediately or, if booking functionality is business-critical, unpublish the shortcode page and restrict wp-admin and order/payment screens to trusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ba Book Everything
View allThe BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booking Algorithms
Stored cross-site scripting in the BA Book Everything plugin for WordPress (all versions up to and including 1.8.28) let
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bookingalgorithms
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' sh
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms
The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and includi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today