BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via Service Quantity
- ID
- WPSEC-2026-0088
- Plugin
- BA Book Everything (ba-book-everything)
- Affected
- from 1.5.0 before 1.8.29
- Remediation
- Update to 1.8.29 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- BA Book Everything on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-102565, on 2026-10-01.
Description
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in versions 1.5.0 up to, and including, 1.8.28. This is due to insufficient input sanitization and output escaping: when a booking is submitted, the service quantity is only checked with loose comparisons ($qty >= 0 and max_quantity >= $qty), which a string such as '0<payload>' passes, and it is then stored with the order and concatenated into the order's service-details HTML without casting or escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into booking orders that will execute whenever a user, including an administrator viewing the order in the admin area, accesses the affected order details. Exploitation requires a bookable item with a service that has quantity selection enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0088/
- https://plugins.svn.wordpress.org/ba-book-everything/tags/1.8.29/
- https://wordpress.org/plugins/ba-book-everything/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS