CVE-2026-1044: WordPress Tennis Court Bookings XSS Flaw

CVE-2026-1044 Overview

The Tennis Court Bookings plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in all versions up to, and including, 1.2.7. The vulnerability stems from insufficient input sanitization and output escaping in multiple PHP files within the plugin. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that execute whenever any user accesses an injected page.

Critical Impact

Authenticated administrators can inject persistent malicious scripts that execute in the browsers of all users viewing affected pages, potentially leading to credential theft, session hijacking, or administrative account compromise on WordPress multi-site installations.

Affected Products

• Tennis Court Bookings WordPress Plugin versions up to and including 1.2.7
• WordPress multi-site installations with the vulnerable plugin
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-02-19 - CVE-2026-1044 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-1044

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability specifically affects WordPress multi-site installations and single-site installations where the unfiltered_html capability has been explicitly disabled. Under normal WordPress single-site configurations, administrators already have the capability to inject arbitrary HTML, making this vulnerability relevant primarily in hardened or multi-site environments where this capability is restricted.

The attack requires network access and authenticated administrator-level credentials. While the attack complexity is elevated due to the specific configuration requirements, successful exploitation enables cross-site impact where injected scripts can affect users across the WordPress installation, including other administrators.

Root Cause

The root cause lies in insufficient input sanitization and output escaping within the plugin's admin settings handling code. Based on the WordPress Plugin Code Review references, the vulnerable code paths exist in multiple view files including calendar_form.php and setting.php. When admin settings are saved, user-supplied input is not properly sanitized before storage, and when these values are subsequently rendered on pages, they are not properly escaped, allowing JavaScript code to execute in users' browsers.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with administrator-level permissions. The exploitation flow involves:

1. An attacker with WordPress administrator access navigates to the Tennis Court Bookings plugin settings page
2. Malicious JavaScript payload is inserted into vulnerable admin setting fields
3. The payload is stored in the WordPress database without proper sanitization
4. When any user (including other administrators) views a page containing the injected content, the malicious script executes
5. The attacker can then steal session cookies, capture credentials, or perform actions on behalf of the victim user

The vulnerability in calendar_form.php at lines 43 and 201 indicates that calendar-related output is rendered without adequate escaping. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-1044

Indicators of Compromise

• Unexpected JavaScript code or <script> tags present in Tennis Court Bookings plugin settings stored in the WordPress database
• Anomalous admin activity logs showing modifications to plugin settings by unusual accounts or at unusual times
• Browser security warnings or Content Security Policy violations when loading pages with booking calendars
• User reports of unexpected redirects, pop-ups, or browser behavior on pages containing the tennis court booking forms

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to WordPress admin plugin settings pages
• Monitor WordPress database tables for stored content containing suspicious JavaScript patterns such as <script>, javascript:, onerror=, or encoded variants
• Deploy browser-based security monitoring to detect script injection attempts and CSP violations
• Review WordPress audit logs for administrator-level changes to the Tennis Court Bookings plugin configuration

Monitoring Recommendations

• Enable comprehensive WordPress admin activity logging with focus on plugin settings modifications
• Implement Content Security Policy headers to restrict script execution sources and report violations
• Configure real-time alerting for database modifications to plugin-related WordPress options tables
• Perform periodic security scans of stored plugin settings for XSS payloads

How to Mitigate CVE-2026-1044

Immediate Actions Required

• Update the Tennis Court Bookings plugin to the latest patched version beyond 1.2.7 when available
• Review and audit current plugin settings for any injected malicious scripts
• Limit administrator access to trusted personnel only and enforce multi-factor authentication
• Implement Content Security Policy headers to mitigate the impact of any successful XSS exploitation
• Consider temporarily disabling the plugin on multi-site installations until a patch is available

Patch Information

As of the publication date, administrators should monitor the WordPress Plugin page and the plugin download repository for security updates that address this vulnerability. The Wordfence Vulnerability Report provides additional remediation guidance and will track patch availability.

Workarounds

• Restrict administrator account access to only essential and highly trusted users
• Implement a Web Application Firewall with XSS detection rules targeting the WordPress admin interface
• On multi-site installations, consider temporarily disabling the plugin until a security patch is released
• Add strict Content Security Policy headers to prevent execution of inline scripts

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or httpd.conf
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# For nginx, add to server block
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";