CVE-2026-88825: iGMS Direct Booking WordPress XSS Flaw

CVE-2026-88825 Overview

CVE-2026-88825 is a stored Cross-Site Scripting (XSS) vulnerability in the iGMS Direct Booking WordPress plugin versions before 2.0. The plugin fails to authorize or escape widget appearance settings, letting unauthenticated attackers inject arbitrary JavaScript. Injected scripts execute in two contexts: when administrators view the plugin settings, and when any visitor loads a page displaying the booking widget. This creates opportunities for administrator account takeover and mass client-side compromise of site visitors. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can store persistent JavaScript that executes in administrator sessions and every visitor's browser, enabling account takeover, session theft, and site defacement.

Affected Products

iGMS Direct Booking WordPress plugin versions prior to 2.0
WordPress installations exposing the plugin's widget appearance settings endpoint
Any public-facing WordPress page rendering the iGMS Direct Booking widget

Discovery Timeline

2026-09-18 - CVE-2026-88825 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-88825

Vulnerability Analysis

The iGMS Direct Booking plugin exposes widget appearance settings without proper access control or output encoding. Two independent flaws combine to create the vulnerability. First, the endpoint that updates widget appearance settings does not verify the caller's identity or capability, so unauthenticated HTTP requests can write configuration values. Second, the stored values are rendered directly into HTML without escaping in both the WordPress admin settings screen and the public widget markup.

An attacker submits crafted values containing HTML or JavaScript. The plugin persists these values to the WordPress options table. When an administrator opens the plugin settings, or when any visitor loads a page containing the widget, the browser parses the malicious payload and executes it in the site's origin.

Root Cause

The root cause is a combined authorization failure and missing output sanitization. The settings update handler lacks a current_user_can() capability check and a valid nonce, so requests bypass the standard WordPress permission model. The rendering code does not apply esc_attr(), esc_html(), or wp_kses() to attacker-controlled values before emitting them into markup.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends an unauthenticated HTTP request to the vulnerable settings endpoint with a JavaScript payload embedded in a widget appearance parameter. The payload persists in the database. Any subsequent administrator visit to the plugin settings page triggers execution in the admin session, allowing the attacker to create new administrator accounts, install malicious plugins, or exfiltrate data. Visitors loading the public booking widget execute the same payload, enabling credential harvesting and drive-by attacks. Refer to the WPScan Vulnerability Report #12337 for technical details.

Detection Methods for CVE-2026-88825

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs stored in WordPress options rows associated with the iGMS Direct Booking plugin.
New WordPress administrator accounts created without a corresponding authorized change ticket.
Outbound requests from visitor browsers to unfamiliar domains immediately after loading pages containing the booking widget.
Web server access logs showing unauthenticated POST requests to iGMS Direct Booking settings endpoints from non-admin IP addresses.

Detection Strategies

Query the wp_options table for iGMS Direct Booking configuration keys and inspect values for HTML or script content.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the plugin's settings endpoint containing script tags, event handler attributes, or encoded JavaScript.
Monitor page rendering with a headless browser or DOM-inspection scanner to identify unexpected script injection on public widget pages.

Monitoring Recommendations

Alert on modifications to WordPress plugin option rows outside of scheduled maintenance windows.
Track administrator session activity for anomalous plugin installations, user role changes, or file uploads following visits to plugin settings pages.
Enable and review WordPress audit logs for capability checks bypassed against plugin REST or admin-ajax endpoints.

How to Mitigate CVE-2026-88825

Immediate Actions Required

Upgrade the iGMS Direct Booking plugin to version 2.0 or later on all WordPress installations.
Audit wp_options entries related to the plugin and remove any values containing HTML or JavaScript payloads.
Reset passwords and rotate session tokens for all administrator accounts if the plugin was internet-exposed before patching.
Review recently created user accounts, installed plugins, and modified theme files for signs of post-exploitation activity.

Patch Information

The vendor addressed CVE-2026-88825 in iGMS Direct Booking version 2.0. Site operators should update through the WordPress plugin manager or by replacing the plugin files with the fixed release. Confirm the installed version in the WordPress admin plugins screen after the upgrade. See the WPScan Vulnerability Report #12337 for advisory details.

Workarounds

Deactivate and delete the iGMS Direct Booking plugin until the site can be updated to version 2.0.
Restrict access to wp-admin and plugin AJAX or REST endpoints using IP allowlisting at the web server or WAF layer.
Apply a Content Security Policy (CSP) that disallows inline scripts on pages rendering the booking widget to limit payload execution.

bash

# Example: block unauthenticated writes to the plugin settings endpoint at the WAF or web server layer
# nginx example — deny POST to plugin admin-ajax action unless the request carries a valid admin cookie
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($arg_action ~* "igms_direct_booking_(save|update)_settings") {
            if ($http_cookie !~* "wordpress_logged_in_") {
                return 403;
            }
        }
    }
}