CVE-2026-96039 in BA Book Everything Plugin
Summary
by MITRE • 09/25/2026
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The BA Book Everything plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.8.27. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue located within the first_name parameter of the booking form functionality. The root cause lies in insufficient input sanitization and output escaping mechanisms, which fail to properly filter or encode user-supplied data before it is processed by the application logic. Consequently, malicious actors can inject arbitrary web scripts into the system that are subsequently stored on the target server rather than being executed immediately during a single request session.
The operational impact of this vulnerability is severe due to its persistent nature and low barrier for exploitation. An unauthenticated attacker does not require valid credentials or administrative privileges to initiate an attack vector. By utilizing the public [babe-booking-form] shortcode, which is accessible to any visitor on the website, a malicious user can place a guest booking that includes specially crafted input in the first_name field. This action allows the attacker to obtain necessary context such as order_id, order_num, and order_hash credentials directly through the normal booking workflow without needing prior authentication. These identifiers are then used to reach the vulnerable action_to_pay() handler, completing the exploit chain entirely from an unauthenticated state.
Once injected, the malicious scripts remain stored in the database associated with the specific booking record. When any user subsequently accesses a page that displays this information or interacts with the affected order details, the embedded JavaScript executes within their browser context. This execution occurs under the security privileges of the victim's session, potentially allowing attackers to steal sensitive cookies, hijack administrative sessions, perform actions on behalf of the user, or redirect victims to phishing sites. The persistence of stored XSS makes it particularly dangerous as every page view involving the compromised data serves as a potential attack vector against multiple users over time.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents Stored XSS where malicious content is saved on the target server and served to other users later. In terms of adversary tactics, this exploit maps to ATT&CK technique T1059 Command and Scripting Interpreter for executing injected code and potentially T1204 User Execution if social engineering is used to lure victims to view infected pages. The lack of authentication requirement also highlights weaknesses in access control assumptions regarding public-facing forms.
To mitigate this vulnerability, administrators must upgrade the BA Book Everything plugin to a version newer than 1.8.27 where these sanitization and escaping issues have been addressed by the developers. Until an update is applied, implementing Web Application Firewall rules that detect and block common XSS payloads in form submissions can provide temporary protection. Additionally, enabling Content Security Policy headers with strict script-src directives can help mitigate the impact of any successfully injected scripts by restricting their execution context. Regular security audits and input validation testing on all public-facing forms are recommended to prevent similar issues in future updates or other plugins.