CVE-2026-73402: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Hakan Ozevin WP BASE Booking

This vulnerability (CVE-2026-73402) in WP BASE Booking (up to version 6.3.2) is a CWE-79 type cross-site scripting flaw. It arises from improper input neutralization during web page generation, which can be exploited by users with subscriber privileges. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges at the subscriber level, user interaction, and it affects confidentiality, integrity, and availability with low impact each.

An attacker with subscriber-level access can exploit this XSS vulnerability to execute arbitrary scripts in the context of other users. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, the impact is limited by the requirement for subscriber privileges and user interaction.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit subscriber privileges and apply standard XSS mitigations where possible.