CVE-2026-96039 describes a stored cross-site scripting vulnerability (CWE-79) in the BA Book Everything plugin for WordPress. The vulnerability arises from insufficient input sanitization and output escaping of the first_name parameter in versions up to 1.8.27. An unauthenticated attacker can place a guest booking using the public shortcode to obtain valid order credentials (order_id, order_num, order_hash) required to reach the vulnerable action_to_pay() handler. This enables injection of arbitrary web scripts that execute whenever a user views the affected pages.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure and user session compromise. The CVSS 3.1 score is 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

No patch or official fix is currently provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to the booking form shortcode to trusted users only to mitigate exploitation risk.