CVE-2026-92561 describes a reflected cross-site scripting vulnerability in the Booking Calendar WordPress plugin by wpdevelop. The flaw exists in the handling of the 'options' parameter due to inadequate input sanitization and output escaping. The plugin's default configuration disables the nonce verification ('booking_is_nonce_at_front_end' option), allowing unauthenticated attackers to send malicious requests that reach the vulnerable code path. This vulnerability affects all versions from 0 up to and including 11.8.2. The CVSS 3.1 score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

An attacker can inject and execute arbitrary web scripts in the context of the vulnerable site by exploiting the reflected XSS vulnerability. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. However, no impact on availability is indicated. The attack requires user interaction (e.g., clicking a crafted link) and does not require authentication due to the disabled nonce check by default.

No official patch or fix is currently documented. Since the vulnerability arises from the default disabled state of the nonce verification, enabling the 'booking_is_nonce_at_front_end' option to enforce nonce checks can mitigate exploitation. Users should monitor the vendor's advisory for any forthcoming official fixes. Until then, avoid exposing the vulnerable parameter to untrusted input and educate users about the risks of clicking suspicious links.