CVE-2026-103425: WordPress Booking Package XSS Vulnerability

CVE-2026-103425 is a stored cross-site scripting vulnerability in the WordPress Booking Package plugin affecting versions up to 1.7.29. Authenticated attackers can inject malicious scripts via the id parameter. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-103425 Overview

CVE-2026-103425 is a Stored Cross-Site Scripting (XSS) vulnerability in the Booking Package plugin for WordPress. The flaw affects all plugin versions up to and including 1.7.29. It stems from insufficient input sanitization and output escaping on the id parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page, enabling session theft, redirection, or administrative action abuse under the context of a higher-privileged user.

Critical Impact
Contributor-level attackers can persist JavaScript payloads that execute against site visitors and administrators, enabling account takeover vectors against WordPress sites running the Booking Package plugin.

Affected Products

Booking Package plugin for WordPress, versions up to and including 1.7.29
WordPress sites allowing contributor-level or higher registration
Any site rendering pages that embed the vulnerable id parameter output

Discovery Timeline

2026-10-14 - CVE-2026-103425 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103425

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting weakness categorized under CWE-79. The Booking Package plugin accepts an id parameter and stores or reflects its value into rendered page output without applying sufficient sanitization or escaping. Because the payload is persisted, every subsequent request that renders the affected page triggers script execution. An attacker only needs contributor-level credentials, which many WordPress deployments provision liberally to guest authors and partners. The injected script runs in the origin of the WordPress site and can read cookies not marked HttpOnly, call administrative REST endpoints on behalf of the viewer, or pivot to editor and administrator sessions.

Root Cause

The plugin's handling of the id request parameter in index.php does not apply WordPress sanitization functions such as sanitize_text_field() on input or esc_attr() / esc_html() on output. Code paths at approximately lines 260, 1099, 1789, and 1802 of index.php in version 1.7.29 emit attacker-controlled data directly into the response. The fix is included in changeset 3728015.

Attack Vector

The attack is delivered over the network against an authenticated endpoint. The attacker, holding a contributor account, submits a crafted id value containing an HTML or JavaScript payload. The plugin stores the payload and later renders it inside a page served to other authenticated and unauthenticated users. When an administrator browses the affected page, the payload executes in their session context. Review the Wordfence Vulnerability Analysis and the WordPress Booking Package Change Set for the specific sinks.

Detection Methods for CVE-2026-103425

Indicators of Compromise

Requests to Booking Package endpoints containing id parameter values with <script>, onerror=, onload=, javascript:, or encoded script fragments.
Unexpected content stored in Booking Package database tables containing HTML tags or event handler attributes.
Outbound browser requests from administrator sessions to attacker-controlled domains shortly after loading a booking page.

Detection Strategies

Audit WordPress contributor and author accounts for unusual booking-related submissions referencing the id parameter.
Review web server access logs for POST or GET requests to Booking Package handlers containing script tags or long encoded payloads in id.
Inspect rendered page HTML for unexpected inline scripts or unknown third-party script sources inside Booking Package containers.

Monitoring Recommendations

Enable WordPress audit logging for content changes made by contributor and author roles.
Deploy a web application firewall rule to flag script-like patterns in the id parameter sent to /wp-admin and /wp-content/plugins/booking-package/ paths.
Alert on new or modified Booking Package records that contain HTML markup when the plugin configuration does not require HTML input.

How to Mitigate CVE-2026-103425

Immediate Actions Required

Upgrade the Booking Package plugin to a version newer than 1.7.29 that includes the fix from changeset 3728015.
Audit all Booking Package records created or modified by contributor-level users since the plugin was installed.
Rotate credentials for any administrator who accessed a potentially injected page before patching.

Patch Information

The vendor addressed the issue in the commit referenced by WordPress Booking Package Change Set 3728015. Install the latest Booking Package release available through the WordPress plugin directory. The fix adds sanitization and escaping around the id parameter in the sinks identified at lines 260, 1099, 1789, and 1802 of index.php.

Workarounds

Restrict contributor-level account creation and review existing low-privilege accounts for legitimacy until the patch is applied.
Deploy a web application firewall rule that blocks script tags and HTML event handlers in the id parameter for Booking Package endpoints.
Temporarily deactivate the Booking Package plugin on sites that cannot upgrade immediately.

bash

# Configuration example: upgrade the plugin via WP-CLI
wp plugin update booking-package
wp plugin get booking-package --field=version