CVE-2026-57639

WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability

State: published CNA: Patchstack CVSS 3.1 7.1 High NVD: deferred

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6.

Affected products

Vendor	Product	Versions
Roland Murg	WP Booking System	≤2.1.0.6

References

External links from the record. They lead to third-party sites.

https://patchstack.com/database/wordpress/plugin/wp-booking-system/vulnerability/wordpress-wp-booking-system-plugin-2-1-… vdb-entry

Dates

Reserved: 2026-06-25
Published: 2026-11-04
Updated: 2026-11-04

CVSS

7.1 High

Version: 3.1
Source: CNA (Patchstack)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.146% probability of exploitation activity in the next 30 days

Percentile: 3.85%
Score date: 2026-11-09
Model: v2026.06.15

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-04

7.1 High CVSS 3.1 · Patchstack, secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

This CVE at nvd.nist.gov