CVE-2026-6910 is a stored cross-site scripting vulnerability in the Bookero.pl – system rezerwacji online WordPress plugin, affecting versions up to and including 2.2. The issue arises because the 'bookero_products' shortcode's 'hide_products' and 'filter_products' attributes are concatenated directly into an inline JavaScript block without proper input sanitization or output escaping in the 'bookero_products()' function. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary scripts that execute in the context of users viewing the compromised pages.

Successful exploitation allows an attacker with contributor-level access or higher to inject and execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the scope of the affected site. There is no indication of impact on availability. The vulnerability requires authentication and does not involve user interaction (no UI required).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and avoid using the vulnerable shortcode attributes. Monitor official safistudio channels for updates and apply any forthcoming patches promptly.