EUVD-2026-63310
GHSA-q388-9hv6-3cxg
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Subscriber credentials required (PR:L), admin must view injected content (UI:R), and script execution crosses into victim's browser scope (S:C) with limited confidentiality, integrity, and availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
AnalysisAI
Stored Cross-Site Scripting in the WP BASE Booking WordPress plugin (versions <= 6.3.2) allows subscriber-level authenticated users to inject malicious JavaScript into booking-related pages rendered for other users. The CVSS vector (PR:L, S:C) confirms that only a low-privilege subscriber account is needed to plant the payload, and a scope change occurs when the script executes in a victim's browser - typically an administrator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid WordPress subscriber account on the target site, meaning either open user registration is enabled or the attacker has obtained subscriber credentials through another means. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:R/S:C reflects a meaningful but bounded threat: network-reachable and low-complexity, but constrained by the need for subscriber-level credentials and victim interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a subscriber account on a target WordPress site with open registration and WP BASE Booking <= 6.3.2 installed, then submits a booking request or fills a profile field with a crafted JavaScript payload. When an administrator later reviews pending bookings or navigates to the page rendering that input, the script executes silently in the admin's browser - exfiltrating the session cookie to an attacker-controlled server or issuing authenticated WordPress API requests to create a new admin user. … |
| Remediation | Update WP BASE Booking to a version above 6.3.2 once a patched release is confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-3-2-cross-site-scripting-xss-vulnerability and the official WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Base Booking
View allUnauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Eve
Privilege escalation in the WP BASE Booking WordPress plugin (versions 6.3.1 and earlier) lets a low-privileged authenti
Unauthenticated privilege escalation in the WP BASE Booking WordPress plugin (versions through 5.9.0) allows remote atta
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today