CVE-2026-102565
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The BA Book Everything plugin for WordPress is vulnerable to stored XSS via the 'booking_service_qty' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.
Risk Assessment
An attacker can steal data from administrators or other privileged users if they open the infected order record in the admin panel.
Recommendation
Update the BA Book Everything plugin to the latest patched version. Restrict access to the admin panel and apply security policies.
Other vulnerabilities in BA Book Everything
See all- CVE-2026-39786High
The WordPress plugin BA Book Everything in versions up to 1.8.33 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.
- CVE-2026-96039High
The BA Book Everything plugin for WordPress (versions up to and including 1.8.27) is vulnerable to stored cross-site scripting via the first_name parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.
Original NVD description (English source)
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator or other privileged user opens the injected order record in the plugin's wp-admin order management area, which is the plugin's ordinary order-review workflow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS