CVE-2026-92561 wpdevelop CVE debrief

Who should care

Defenders responsible for WordPress installations with the Booking Calendar plugin should assess exposure and prioritize verification and remediation efforts. This includes reviewing the plugin version, assessing user interaction exposure, and implementing necessary security measures to prevent exploitation. Additionally, security teams should monitor for potential attacks and review logs for exposed assets.

Why it matters

CVE-2026-92561 is a Reflected Cross-Site Scripting vulnerability in the Booking Calendar plugin for WordPress. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of user interactions with the plugin. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Remediation priority is medium due to the CVSS score of 6.1 and MEDIUM severity.

• Defenders must verify the presence of this vulnerability in their WordPress installations.
• User interactions with the Booking Calendar plugin may be exposed to Reflected Cross-Site Scripting attacks.
• Successful exploitation requires tricking a user into performing an action such as clicking on a link.
• Remediation priority is medium due to the CVSS score of 6.1 and MEDIUM severity.

Technical summary

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of user interactions with the Booking Calendar plugin.

Recommended defensive actions

• Verify the presence of the Booking Calendar plugin version 11.8.2 or earlier in your WordPress installations.
• Assess exposure of user interactions with the Booking Calendar plugin.
• Implement input sanitization and output escaping for the 'options' parameter.
• Monitor for potential attacks exploiting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.