CVE-2026-10148: WordPress Booking Plugin XSS Vulnerability

CVE-2026-10148 Overview

The Booking for Appointments and Events Calendar plugin for WordPress, also known as AmeliaBooking, contains a Stored Cross-Site Scripting (XSS) vulnerability across multiple Elementor widgets. The flaw affects all versions up to and including 2.4.9 and stems from insufficient input sanitization and output escaping on the load_manually parameter within the render() methods of several widget classes. Authenticated users with Contributor-level access or higher who can use Elementor can inject arbitrary JavaScript that executes when other users view the affected page. The vendor issued a partial fix in version 2.4.8, but the vulnerability remained exploitable through additional widget paths.

Critical Impact
Contributor-level attackers can persist JavaScript payloads inside Elementor widget output, enabling session theft, forced administrative actions, and site defacement against visitors of injected pages.

Affected Products

Booking for Appointments and Events Calendar (AmeliaBooking) plugin for WordPress — versions up to and including 2.4.9
Elementor widget classes: AmeliaEventsCalendarBookingElementorWidget, AmeliaEventsElementorWidget, AmeliaEventsListBookingElementorWidget, AmeliaStepBookingElementorWidget
WordPress sites running Elementor with Contributor-or-higher user roles enabled

Discovery Timeline

2026-09-12 - CVE-2026-10148 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-10148

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. It resides in the render() methods of multiple Elementor widget classes shipped by the AmeliaBooking plugin. Each affected widget reads the load_manually control value and emits it into the rendered HTML without applying WordPress escaping helpers such as esc_attr() or esc_html(). Because the payload is persisted in the Elementor page definition, it re-executes for every subsequent viewer of the page. The plugin author released a partial patch in version 2.4.8 that addressed some of the widgets, but additional injection points remained until the follow-up fix delivered via WordPress Changeset 3687762.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the load_manually widget setting. The affected code paths accept attacker-controlled markup and interpolate it directly into HTML attributes or content, breaking the assumption that widget settings contain benign strings. Relevant locations include line 186 of AmeliaEventsCalendarBookingElementorWidget.php, line 134 of AmeliaEventsElementorWidget.php, line 247 of AmeliaEventsListBookingElementorWidget.php, and lines 200 and 226 of AmeliaStepBookingElementorWidget.php.

Attack Vector

An authenticated Contributor-or-higher user opens an Elementor-editable page and inserts an affected AmeliaBooking widget. The attacker supplies a crafted value for the load_manually control containing JavaScript. When any user, including administrators, loads the resulting page, the injected script executes in the victim's browser session. Because the CVSS scope is Changed, the impact reaches beyond the vulnerable component to affect authenticated administrator sessions and site visitors.

No verified public exploit code is currently available. See the Wordfence Vulnerability Report and the vulnerable widget source referenced in the AmeliaBooking Trunk Calendar Widget for the exact injection points.

Detection Methods for CVE-2026-10148

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: handlers stored inside Elementor page data (_elementor_data postmeta) that reference AmeliaBooking widgets.
New or modified WordPress posts and pages containing AmeliaBooking Elementor widgets edited by Contributor or Author accounts.
Outbound browser requests from administrator sessions to unknown domains immediately after loading pages that embed AmeliaBooking widgets.

Detection Strategies

Query the wp_postmeta table for the _elementor_data key and search widget settings for the load_manually field containing HTML tags or script fragments.
Review Elementor revision history for AmeliaBooking widget insertions authored by low-privilege users.
Deploy a web application firewall rule that inspects rendered pages for reflected AmeliaBooking widget output containing script-like content.

Monitoring Recommendations

Alert on any Contributor or Author account editing pages that contain AmeliaBooking widgets.
Monitor administrator browser sessions for anomalous XHR or fetch calls that follow visits to booking pages.
Track WordPress audit logs for creation of new administrator accounts, plugin installations, or role changes shortly after suspicious page edits.

How to Mitigate CVE-2026-10148

Immediate Actions Required

Update the Booking for Appointments and Events Calendar (AmeliaBooking) plugin to the latest release beyond version 2.4.9 that incorporates WordPress Changeset 3687762.
Audit all Elementor pages that use AmeliaBooking widgets and remove any embedded scripts from widget settings.
Review Contributor, Author, and Editor accounts and revoke access for users that do not require Elementor editing rights.

Patch Information

The vulnerability was partially patched in version 2.4.8 via WordPress Changeset 3657136 and fully addressed in a later release via WordPress Changeset 3687762. Site administrators should upgrade to the newest available plugin version to ensure all vulnerable render() methods apply proper output escaping.

Workarounds

Temporarily restrict Elementor editing capabilities to Administrator accounts by removing the edit_posts capability from lower roles where feasible.
Deploy a WordPress-aware WAF rule set that blocks script tags and event handler attributes submitted to Elementor widget settings.
Disable the AmeliaBooking Elementor widgets on affected pages until the plugin is upgraded.

bash

# Verify installed AmeliaBooking plugin version and update via WP-CLI
wp plugin get ameliabooking --field=version
wp plugin update ameliabooking

# Search post meta for suspicious script content in Elementor data
wp db query "SELECT post_id FROM wp_postmeta WHERE meta_key='_elementor_data' AND meta_value LIKE '%load_manually%<script%';"