Security Alert Summary
The Booking Package plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the id parameter in all versions up to and including 1.7.29. Insufficient input sanitization and output escaping allow authenticated users with contributor-level access or higher to inject script code that will execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2026-103425
- Affected product: Booking Package plugin for WordPress
- Affected versions: All versions up to and including 1.7.29
- Published: October 14, 2026 at 02:16:55 AM UTC
- Last modified: October 14, 2026 at 02:26:59 PM UTC
- CVSS v3.1: Base score 6.4 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Authentication required (authenticated user). Privileges required: LOW (contributor-level or above). User interaction: NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue that arises from insufficient input sanitization and missing or inadequate output escaping for the id parameter. An authenticated attacker with contributor-level access or higher can store arbitrary script content that will be rendered in a page context and executed when another user accesses that page.
The root cause is inadequate handling of user-supplied input before persisting or outputting it to pages. The description identifies the id parameter as the injection vector. No additional functions, endpoints, or code paths are named in the provided data.
Impact is limited to actions consistent with stored XSS: execution of injected scripts in the context of a victim’s browser, which may lead to disclosure of data visible to that user, session-related actions within the victim’s privileges, or content manipulation. The CVSS metrics indicate confidentiality and integrity impacts are low and availability is not affected.
How This Could Impact Your Website
Consider a small business site where the site owner manages administrative settings, an internal staff member creates content, and an external contractor or contributor adds or edits bookings. A contributor who can control the vulnerable id parameter could inject a script into a page that executes when staff or contractors view that page. This could expose information visible to those accounts (for example, user-visible profile or contact details) or allow an attacker to perform actions available to the viewing user within their browser session.
Practical consequences include the potential exposure of internal user email addresses and an increased risk of targeted phishing or social engineering against staff who view affected pages. The issue does not imply full site compromise; impacts align with the CVSS assessment of low confidentiality and integrity impact and no availability impact.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual behavior related to content changes or unexpected script content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L1099
- https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L1789
- https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L1802
- https://plugins.trac.wordpress.org/browser/booking-package/tags/1.7.29/index.php#L260
- https://plugins.trac.wordpress.org/changeset/3728015/booking-package/trunk/index.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/10293e5a-15ea-42c1-a0df-b95f723a75a3?source=cve
