CVE-2026-102565 is a stored Cross-Site Scripting vulnerability in the BA Book Everything plugin for WordPress. The flaw arises from insufficient input sanitization and output escaping of the 'booking_service_qty' parameter in all versions up to 1.8.28. An unauthenticated attacker can inject arbitrary web scripts that execute in the context of the admin user when they access the injected order record in the wp-admin order management area. This vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope change.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of an administrator or privileged user, potentially leading to information disclosure or manipulation of plugin data. The attack requires the privileged user to open the malicious order record, which is part of normal plugin usage. There is no indication of availability impact or known active exploitation in the wild.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict access to the plugin's order management interface to trusted administrators only and exercise caution when reviewing orders. Avoid opening suspicious or unexpected order records. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.