CVE-2026-1607 is a stored cross-site scripting vulnerability in the Surbma | Booking.com Shortcode WordPress plugin (all versions up to 2.1). The vulnerability is due to improper neutralization of input during web page generation (CWE-79), specifically insufficient input sanitization and output escaping of user-supplied attributes in the surbma-bookingcom shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of users viewing the compromised pages. This vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No patch or official remediation is currently documented.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of user credentials, session tokens, or other sensitive information. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Surbma | Booking.com Shortcode plugin if feasible. Monitor for updates from the vendor regarding patches or mitigations.