CVE-2026-1945 is a stored cross-site scripting vulnerability in the WPBookit plugin for WordPress, affecting all versions up to and including 1.0.8. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'wpb_user_name' and 'wpb_user_email' parameters. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages, potentially leading to confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 score of 7.2, reflecting high severity. No patch or remediation details are currently available from the vendor or other authoritative sources.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, which can lead to the execution of arbitrary scripts in the context of users visiting the affected pages. This can result in partial confidentiality and integrity impacts, such as theft of user data or session hijacking. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WPBookit plugin or applying any recommended temporary mitigations from the vendor. Monitor official vendor channels for updates regarding patches or fixes.