CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.

• CWE-79

• https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-html.php#L4300
• https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2405
• https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2522
• https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2599
• https://plugins.trac.wordpress.org/browser/ba-book-everything/tags/1.8.27/includes/class-babe-order.php#L2653
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3709588%40ba-book-everything%2Ftrunk&old=3640320%40ba-book-everything%2Ftrunk
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dd118053-b0f7-4fce-aa00-b0bb40778f21?source=cve

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95958A security flaw has been discovered in JusticeRage Manalyze …3.3
• CVE-2026-9597Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail …5.4
• CVE-2026-95985The file write tool in Amazon Kiro IDE versions before 1.0.2…8.8
• CVE-2026-9599The Tectite Forms plugin for WordPress is vulnerable to Cros…4.3
• CVE-2026-9602Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to…6.5
• CVE-2026-9603A security vulnerability has been detected in SourceCodester…6.5
• CVE-2026-9604A vulnerability was detected in JeecgBoot up to 3.9.1. This …4.3
• CVE-2026-9605A flaw has been found in GNU libredwg up to 0.13.4.8160. Thi…7.3
• CVE-2026-9606A vulnerability has been found in itsourcecode Courier Manag…7.3
• CVE-2026-9607A vulnerability was found in itsourcecode Courier Management…6.3
• CVE-2026-9608A vulnerability was determined in QianFox FoxCMS up to 1.2.6…2.4
• CVE-2026-9609A vulnerability was identified in QianFox FoxCMS up to 1.2.6…4.7