What is the CVSS score of EUVD-2026-32106?

EUVD-2026-32106 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by EUVD-2026-32106?

The HBook hotel booking plugin for WordPress (versions through 2.1.6) contains a stored cross-site scripting vulnerability (CVE-2026-8143, CVSS 7.2) that allows unauthenticated attackers to inject…

How to fix or mitigate EUVD-2026-32106?

Within 24 hours: Audit all WordPress installations to identify HBook plugin presence and current versions. Within 7 days: Implement input validation controls via WAF or plugin configuration on booking parameters (hb_country_iso, hb_usa_state_iso, hb_canada_province_iso); restrict HBook admin page access to known IP ranges; evaluate alternative booking plugins. Within 30 days: Either disable HBook if not actively used, or migrate to alternative plugin; establish ongoing plugin security monitoring.

WordPress EUVD-2026-32106

| CVE-2026-8143 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-j6cw-vh4x-xqjh

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:45 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

HIGH 7.2

DescriptionCVE.org

The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' parameters in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the HBook Customers admin page).

AnalysisAI

Stored cross-site scripting in the HBook hotel booking plugin for WordPress (all versions through 2.1.6) lets unauthenticated attackers persist arbitrary JavaScript through the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' booking parameters. The payload is stored server-side and fires in the privileged context of the HBook Customers admin page, so a no-privilege injection escalates into the administrator's browser session (reflected in the Scope:Changed rating that drives the 7.2 score). There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 17th percentile).