CVE-2026-109147: CWE-79 Cross-Site Scripting (XSS) in WP Booking System

The WP Booking System WordPress plugin versions prior to 2.1.0.3 contain a reflected Cross-Site Scripting (CWE-79) vulnerability. This occurs because the plugin fails to validate and escape one of its input parameters before reflecting it back in an administrative interface page. An attacker could leverage this to inject malicious scripts that execute in the browser of an administrator or other privileged user viewing the affected page.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an administrator's browser session. This may lead to session hijacking, unauthorized actions within the admin interface, or other attacks that rely on script execution in a privileged context. However, there is no indication of known exploits in the wild at this time.

A fixed version of the WP Booking System plugin is available at version 2.1.0.3. Users should upgrade to version 2.1.0.3 or later to remediate this vulnerability. Since this is a plugin vulnerability and not a cloud service, manual update by the site administrator is required. Patch status is confirmed by the versioning information provided.