CVE-2026-93655 is a reflected cross-site scripting vulnerability in the Booking Calendar WordPress plugin by wpdevelop. The flaw exists in the handling of the 'wpbc_auto_fill' parameter, where input is not properly sanitized or escaped before being included in web pages. This enables unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if the victim is tricked into clicking a crafted link. The vulnerability affects all plugin versions from 0 through 11.8.3.

Successful exploitation can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of the victim's browser. This can result in actions such as session hijacking or defacement, but does not affect availability. The attack requires user interaction (clicking a malicious link) and no privileges are needed to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links related to the Booking Calendar plugin and consider disabling or restricting access to the vulnerable functionality. Monitor the vendor's official channels for updates and patches.