CVE-2026-93655 in Booking Calendar Plugin
Summary
by MITRE • 09/22/2026
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The Booking Calendar plugin, widely utilized within the WordPress ecosystem to manage appointments and reservations, contains a critical security flaw identified as Reflected Cross-Site Scripting. This vulnerability exists in all versions up through 11.8.3 and stems from insufficient input sanitization and output escaping mechanisms when handling the wpbc_auto_fill parameter. The core technical issue lies in the application's failure to properly validate or encode user-supplied data before rendering it back into the HTTP response. When a request is made with maliciously crafted content within this specific parameter, the server processes the input without adequate filtering and subsequently reflects that untrusted data directly into the HTML output of the page. This behavior creates an execution environment where injected JavaScript code can run in the context of the victim's browser session, provided the user interacts with a specially constructed link or form submission directed at the vulnerable endpoint.
From a technical perspective, this flaw represents a classic instance of reflected cross-site scripting, which is formally categorized under CWE-79: Improper Neutralization of Input During Web Page Generation in Common Weakness Enumeration standards. The vulnerability does not require any authentication privileges to exploit, classifying it as an unauthenticated attack vector. This significantly lowers the barrier for entry for threat actors, allowing anyone on the internet with basic web exploitation knowledge to craft payloads that target users who visit compromised or maliciously linked pages. The lack of output escaping means that special characters such as angle brackets and quotation marks are not converted into their corresponding HTML entities, thereby permitting the browser to interpret injected strings as executable script tags rather than plain text data.
The operational impact of this vulnerability is severe due to its potential for session hijacking, credential theft, and defacement. An attacker can leverage this flaw to execute arbitrary JavaScript code within the victim's browser context. This capability enables a range of malicious activities including stealing administrative cookies or authentication tokens, redirecting users to phishing sites designed to capture login credentials, keylogging user inputs on sensitive forms, or performing actions on behalf of the authenticated user without their consent. Since WordPress plugins often operate with elevated privileges depending on the role of the logged-in administrator who views the affected page, compromising an admin account through this vector can lead to full site compromise and control over all associated data and functionality.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The most effective solution is to upgrade the Booking Calendar plugin to a version later than 11.8.3 where these input validation and output escaping issues have been resolved by the developers. In scenarios where an immediate update is not feasible, administrators should implement web application firewall rules that detect and block requests containing suspicious script tags or encoded payloads within the wpbc_auto_fill parameter. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of successful exploitation by restricting the sources from which scripts are allowed to execute. Regular security audits and code reviews focusing on input sanitization practices are essential for preventing similar vulnerabilities in future plugin updates or custom integrations.
This vulnerability aligns with several tactics within the MITRE ATT&CK framework, particularly those related to Client Side Attacks and Collection of Application Data. Attackers typically use social engineering techniques such as phishing emails containing malicious links to trick users into triggering the reflected script. Once executed, the payload may attempt to exfiltrate sensitive information like session cookies or form data back to a remote server controlled by the attacker. Understanding this attack chain highlights the importance of not only patching software but also educating end-users about the risks of clicking on untrusted links and monitoring for unusual activity indicative of client-side exploitation attempts within WordPress environments.