CVE-2026-39786
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WordPress plugin BA Book Everything in versions up to 1.8.33 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.
Risk Assessment
This can lead to execution of malicious code in the user's browser, session theft, or account takeover. The risk affects all sites with the vulnerable plugin version installed.
Recommendation
Update the BA Book Everything plugin to the latest version (above 1.8.33). If updating is not possible, consider disabling the plugin until a fix is released.
Other vulnerabilities in BA Book Everything
See all- CVE-2026-102565High
The BA Book Everything plugin for WordPress is vulnerable to stored XSS via the 'booking_service_qty' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.
- CVE-2026-96039High
The BA Book Everything plugin for WordPress (versions up to and including 1.8.27) is vulnerable to stored cross-site scripting via the first_name parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS