CVE-2026-6910

The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `<script>` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/bookeropl/tags/2.1/libraries/bookero-front.php#L173
• https://plugins.trac.wordpress.org/browser/bookeropl/tags/2.1/libraries/bookero-front.php#L174
• https://plugins.trac.wordpress.org/browser/bookeropl/trunk/libraries/bookero-front.php#L173
• https://plugins.trac.wordpress.org/browser/bookeropl/trunk/libraries/bookero-front.php#L174
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3524452%40bookeropl&new=3524452%40bookeropl
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd0e6ca6-f6a7-4e81-aea1-3b59de0173d6?source=cve

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69093Admidio before 5.0.11 does not validate the adm_csrf_token i…7.1
• CVE-2026-69094Admidio before 5.0.11 contains an insecure direct object ref…5.3
• CVE-2026-69095OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389db…8.7
• CVE-2026-69096OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 sn…8.8
• CVE-2026-69097GitPython before 3.1.53 fails to properly escape section nam…7.3
• CVE-2026-69098kotaemon through 0.12.0 contains an insecure deserialization…9.8
• CVE-2026-69100LAMP Rapid Development Platform through 5.6.2, fixed in comm…8.8
• CVE-2026-69102MaxKey contains an unauthorized access vulnerability due to …9.8
• CVE-2026-69108A vulnerability has been identified in Siemens License Serve…8.3
• CVE-2026-69109A vulnerability has been identified in Siemens License Serve…8.7
• CVE-2026-6911Missing JWT signature verification in AWS Ops Wheel allows u…9.8
• CVE-2026-69110OpenCode Studio before 2.4.4 contains a missing authenticati…9.3