CVE-2026-92561

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification.

• CWE-79

• https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/core/lib/wpbc-ajax.php#L25
• https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/core/timeline/v2/wpbc-class-timeline_v2.php#L3385
• https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/core/timeline/v2/wpbc-class-timeline_v2.php#L593
• https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/core/timeline/v2/wpbc-class-timeline_v2.php#L919
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3699185%40booking&new=3699185%40booking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e8645b58-6b2a-4659-a002-d622453bea42?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92541The Import and export users and customers WordPress plugin b…7.2
• CVE-2026-9255Missing input source validation in the tool authorization pr…8.4
• CVE-2026-92550A pre-authentication attacker could leverage type size/count…7.5
• CVE-2026-92554The ShopLentor – All-in-One WooCommerce Growth & Store Enhan…6.1
• CVE-2026-9256NGINX Plus and NGINX Open Source have a vulnerability in the…8.1
• CVE-2026-92560A pre-authentication attacker could leverage type size/count…7.5
• CVE-2026-92564A pre-authentication attacker could leverage type nesting to…
• CVE-2026-92565Rallly before 4.15.0 contains an information disclosure vuln…5.3
• CVE-2026-92566DataGear through 6.0.0 contains a server-side request forger…8.2
• CVE-2026-92567TDuck survey form through version 5.0 contains an authorizat…6.5
• CVE-2026-92568MLRun through 1.11.0 contains a server-side request forgery …5.4
• CVE-2026-92569Hippo4j through 1.5.0 contains a server-side request forgery…4.3