CVE-2026-88825 in iGMS Direct Booking Plugin
Summary
by MITRE • 09/18/2026
The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within versions of the iGMS Direct Booking WordPress plugin prior to version 2.0 represents a critical failure in input validation and output encoding mechanisms. This flaw allows unauthenticated attackers to inject arbitrary web scripts into the application's configuration settings, specifically targeting the widget appearance parameters. The root cause lies in the plugin's handling of user-supplied data during the storage phase for administrative settings. Instead of sanitizing or escaping special characters that could be interpreted as executable code, the system stores these inputs directly without adequate protection against Cross-Site Scripting vectors. This lack of proper encoding means that any script tags, event handlers, or other malicious payloads embedded within the widget appearance configuration are preserved in their raw form when retrieved and rendered by the browser.
From a technical perspective, this vulnerability facilitates both Stored Cross-Site Scripting and potentially Reflected Cross-Site Scripting depending on how the data is subsequently accessed. When an administrator accesses the plugin's settings page to review or modify configurations, the malicious script stored in the widget appearance field executes within their browser session context. This execution occurs because the application fails to escape HTML entities such as less-than and greater-than signs, allowing the browser to interpret the injected content as active code rather than static text. Furthermore, since this data is part of a public-facing booking widget displayed on web pages visited by general users, any visitor viewing these pages will also have their browsers execute the malicious script. This dual execution path significantly amplifies the severity and potential impact of the vulnerability across both administrative and end-user environments.
The operational impact of this flaw is severe due to its unauthenticated nature and broad scope. For administrators, successful exploitation can lead to session hijacking if cookies are accessible via JavaScript, allowing attackers to impersonate the administrator and gain full control over the WordPress installation. This could result in complete compromise of the website's backend, including access to sensitive customer data, financial records associated with bookings, and the ability to install further malware or backdoors. For regular visitors, the impact includes potential credential theft if login forms are present on the same domain, phishing attacks through deceptive UI overlays injected by the script, or redirection to malicious sites designed to distribute ransomware or other threats. The persistence of this payload means that every subsequent visit to affected pages exposes users to risk until the vulnerability is patched and existing payloads are removed from the database.
This vulnerability aligns with Common Weakness Enumeration CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it reflects a failure in both input validation (CWE-20) and output encoding (CWE-116). In terms of the MITRE ATT&CK framework for enterprise security, this exploit maps to techniques involving Client-Side Injection such as T1059.007 which covers JavaScript execution within web browsers. The attack vector is classified under Initial Access via Web Application Exploitation, leveraging the trust that users and administrators place in legitimate-looking administrative interfaces or trusted booking widgets on public-facing sites.
Mitigation strategies must focus on immediate remediation of the codebase alongside broader security hygiene practices. The primary corrective action is to upgrade the iGMS Direct Booking WordPress plugin to version 2.0 or later, where these input validation and output encoding flaws have been addressed by the developers. For organizations unable to update immediately due to compatibility constraints, a temporary workaround involves manually sanitizing any existing entries in the database that correspond to widget appearance settings, ensuring no script tags or event handlers remain stored. Additionally, implementing a Content Security Policy header can help mitigate the impact of successful injections by restricting the sources from which scripts are allowed to execute, although this is not a substitute for fixing the underlying code vulnerability. Regular security audits and penetration testing should be conducted on all third-party WordPress plugins to ensure they adhere to secure coding standards and properly handle user input across all administrative and public-facing interfaces.