CVE-2026-8143: HBook WordPress Plugin XSS Vulnerability

CVE-2026-8143 Overview

CVE-2026-8143 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the HBook plugin for WordPress in all versions up to and including 2.1.6. The flaw exists in the handling of the hb_country_iso, hb_usa_state_iso, and hb_canada_province_iso parameters, which lack sufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator views the affected HBook Customers admin page. The vulnerability is classified under CWE-79 for improper neutralization of input during web page generation.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in the context of WordPress administrators viewing the HBook Customers page, enabling session theft, account takeover, and further site compromise.

Affected Products

HBook - Hotel Booking System WordPress Plugin versions 1.0 through 2.1.6
WordPress installations with the HBook plugin enabled
Hotel and booking sites using HBook for customer reservation management

Discovery Timeline

2026-05-27 - CVE-2026-8143 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8143

Vulnerability Analysis

The HBook plugin processes booking form submissions that include geographic identifier parameters for country, U.S. state, and Canadian province selections. These parameters are stored in the WordPress database as part of customer reservation records. When an administrator opens the HBook Customers admin page, the plugin renders these stored values directly into HTML without proper escaping.

An unauthenticated attacker can submit a booking request containing JavaScript payloads in the hb_country_iso, hb_usa_state_iso, or hb_canada_province_iso fields. The malicious payload persists in the database and executes in the administrator's browser session upon page rendering. This creates a persistent attack surface accessible to anyone who can interact with the booking form.

Root Cause

The root cause is twofold. First, the plugin fails to validate or sanitize the ISO code parameters on input, accepting arbitrary string content instead of restricting values to recognized ISO 3166 codes. Second, the plugin omits output escaping functions such as esc_html() or esc_attr() when rendering the stored values in the admin interface. The combination allows raw script content to reach the browser's HTML parser.

Attack Vector

The attack is conducted over the network without authentication or user interaction from the attacker side. An adversary submits a crafted booking form containing a script payload in one of the vulnerable ISO parameters. The payload is stored persistently. When an administrator subsequently views the HBook Customers admin page, the script executes with the administrator's privileges, enabling cookie theft, CSRF token extraction, or injection of additional administrative actions.

The vulnerability is described in detail in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-8143

Indicators of Compromise

Booking records containing HTML tags, <script> elements, or JavaScript event handlers in the country, state, or province fields
Unexpected outbound requests originating from administrator browser sessions after accessing the HBook Customers page
New or modified WordPress administrator accounts following access to the HBook admin interface
Anomalous booking submissions with non-ISO-3166 values in geographic identifier fields

Detection Strategies

Query the WordPress database for HBook customer records containing characters such as <, >, ", or javascript: within ISO code columns
Monitor web server logs for POST requests to HBook booking endpoints that contain encoded script payloads
Review WordPress admin session activity for unexpected privilege changes or plugin modifications
Deploy a Web Application Firewall (WAF) rule that flags submissions to HBook endpoints containing HTML or JavaScript syntax

Monitoring Recommendations

Enable WordPress audit logging for administrative actions performed while the HBook Customers page is open
Alert on creation of new administrator accounts or modification of user roles immediately after HBook admin page visits
Track outbound HTTP requests from admin browsers for evidence of data exfiltration to attacker-controlled domains

How to Mitigate CVE-2026-8143

Immediate Actions Required

Update the HBook plugin to a version newer than 2.1.6 as soon as a patched release is available from the vendor
Deactivate the HBook plugin if no patched version is available and the booking functionality is not business-critical
Audit existing HBook customer records and remove or sanitize entries containing script content in ISO parameter fields
Rotate WordPress administrator session cookies and reset administrator passwords if compromise is suspected

Patch Information

No patched version is documented in the available references at the time of NVD publication. Administrators should monitor the CodeCanyon Product Page for updates and review the Wordfence Vulnerability Report for remediation guidance.

Workarounds

Deploy a WAF rule that blocks requests to HBook booking endpoints containing <, >, or javascript: within hb_country_iso, hb_usa_state_iso, or hb_canada_province_iso parameters
Restrict access to the WordPress admin interface using IP allowlisting until the plugin is patched
Implement a strict Content Security Policy (CSP) that disallows inline script execution on WordPress admin pages
Temporarily disable the HBook Customers admin page rendering by removing the menu registration in the plugin code

bash

# Example WAF rule (ModSecurity) blocking script injection in HBook parameters
SecRule ARGS:hb_country_iso|ARGS:hb_usa_state_iso|ARGS:hb_canada_province_iso \
    "@rx (?i)(<script|javascript:|onerror=|onload=|<svg|<iframe)" \
    "id:1008143,\
     phase:2,\
     deny,\
     status:403,\
     msg:'Blocked HBook XSS attempt - CVE-2026-8143',\
     tag:'CVE-2026-8143'"