WP Booking System CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review WP Booking System CVE published 2026-10-14

CVE-2026-107126

The WP Booking System plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in versions prior to 2.1.0.1. This vulnerability allows unauthenticated attackers to inject malicious scripts into the plugin's administrative interface via the X-Forwarded-For header. When an administrator views the stored data, the script executes in their session.