CVE-2026-103425: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in masaakitanaka Booking Package

CVE-2026-103425 is a stored cross-site scripting vulnerability in the masaakitanaka Booking Package WordPress plugin. The flaw exists in the handling of the 'id' parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users viewing the injected pages. This affects all versions up to and including 1.7.29.

Successful exploitation allows an attacker to execute arbitrary scripts in the browsers of users who visit the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires authenticated access with contributor-level permissions or higher, limiting the attack surface. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and no user interaction required.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider additional input validation or web application firewall rules to mitigate exploitation risk.