CVE-2026-8791 describes a stored cross-site scripting vulnerability in the Booking System Trafft WordPress plugin (up to and including version 1.0.17). The flaw arises because the AJAX action 'set_options' lacks a proper capability check when the plugin operates in agency mode. Although the trafftSetOptions() handler verifies a nonce accessible to any authenticated user, it does not verify user capabilities before updating the 'bookingWebsiteUrl' option. This URL is then used by the trafftAdminAssets() function to enqueue a script from the specified URL on all front-end pages rendering the booking shortcode. Consequently, an authenticated attacker with Subscriber-level privileges or higher can set this URL to an attacker-controlled origin, causing arbitrary JavaScript execution in the browsers of all site visitors, including administrators.

An attacker with at least Subscriber-level access to the WordPress site can exploit this vulnerability to execute arbitrary JavaScript in the context of the affected site for all visitors. This can lead to session hijacking, privilege escalation, or other malicious actions performed in the context of the victim's browser. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 6.4, indicating medium severity.

No official patch or remediation has been confirmed at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only, especially limiting Subscriber-level users from accessing administrative AJAX actions. Monitor for plugin updates from the vendor and apply them promptly once released.