Security Alert Summary
The WPBookit plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the handling of the wpb_user_name and wpb_user_email parameters. Insufficient input sanitization and output escaping can allow an unauthenticated attacker to inject scripts that execute when a user views an affected page.
CVE Details
- CVE ID: CVE-2026-1945
- Affected plugin / component: WPBookit plugin for WordPress
- Affected versions: All versions up to, and including, 1.0.8
- Fixed version: Not specified in the CVE entry
- Published: March 4, 2026 at 2:15:53 AM (UTC)
- Last modified: March 4, 2026 at 2:15:53 AM (UTC)
- CVSS v3.1: Base score 7.2, severity HIGH, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Attack vector / complexity: Network / Low
- Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue caused by insufficient input sanitization and missing output escaping for two parameters: wpb_user_name and wpb_user_email. Because these values are stored and later rendered in pages without proper encoding, an attacker can insert arbitrary web script into those fields. When a victim views a page containing the stored payload, the injected script will execute in the victim’s browser context.
The CVE description identifies the specific parameters involved and cites lack of sanitization and escaping as the root cause. The impact is limited to script execution in the context of pages that render the stored values; the entry does not describe any additional vectors, functions, or REST endpoints beyond those parameters.
How This Could Impact Your Website
In a typical WordPress site with multiple users—such as a site owner, editorial staff, and external contributors or contractors—an unauthenticated attacker could submit malicious content through the affected fields. For example, an external contractor submitting booking information might include a script in the wpb_user_name or wpb_user_email field. When an internal staff member or the site owner views the booking page, the script could run in their browser.
Practical consequences include limited exposure of data accessible to the rendered page and the potential to execute actions available in the user’s browser (such as reading visible page content or manipulating the DOM). Given the CVSS impacts (low confidentiality and integrity impact, no availability impact), this vulnerability increases the risk of targeted phishing or social engineering rather than indicating full site compromise. It can also reveal internal email addresses or other information displayed on affected pages, enabling more convincing phishing attempts.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts that can submit content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, particularly new or modified content submitted through booking or form fields.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/controllers/class.wpb-booking-shortcode-controller.php#L534
- https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-booking-shortcode-controller.php#L534
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3467556%40wpbookit&new=3467556%40wpbookit&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5954c682-c772-420a-a764-342418c1e71c?source=cve
