CVE-2026-8143 is a stored cross-site scripting vulnerability in the HBook WordPress plugin used in omnivo's Booking Calendar – Event Calendar. The issue arises from improper neutralization of input in the parameters 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso', allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when users visit the HBook Customers admin page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 2.1.6. The CVSS 3.1 base score is 7.2 (high), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor-provided patch or official remediation at this time.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of the affected WordPress admin page. This can lead to unauthorized actions such as session hijacking or manipulation of admin interface content, impacting confidentiality and integrity of the affected system. There is no direct availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected admin pages to trusted users only and monitor for suspicious activity. Avoid using affected plugin versions in untrusted environments. Follow vendor communications closely for updates on patches or official mitigations.