CVE-2026-6910 describes a stored Cross-Site Scripting vulnerability in the Bookero.pl – system rezerwacji online WordPress plugin, specifically in versions up to and including 2.2. The issue arises from insufficient input sanitization and output escaping in the bookero_products() function, where the hide_products and filter_products shortcode attributes are concatenated directly into an inline <script> block. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability impacts confidentiality and integrity but does not affect availability.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially leading to data theft, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid using the vulnerable shortcode attributes (hide_products and filter_products) in content. Monitor vendor channels for updates and apply patches promptly once released.