CVE-2026-92561 Overview
The Booking Calendar plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability in the options parameter. All versions up to and including 11.8.2 are affected. The plugin fails to sanitize input and escape output before reflecting the parameter value back to the browser. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser after the victim clicks a crafted link. The default configuration ships with the booking_is_nonce_at_front_end option disabled, which bypasses nonce verification and allows unauthenticated requests to reach the vulnerable sink. The issue is tracked under [CWE-79].
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and administrative account takeover through social engineering.
Affected Products
- WordPress Booking Calendar plugin versions up to and including 11.8.2
- WordPress sites with the plugin installed using default configuration
- Sites where booking_is_nonce_at_front_end remains disabled
Discovery Timeline
- 2026-09-18 - CVE-2026-92561 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-92561
Vulnerability Analysis
The vulnerability resides in the Booking Calendar plugin's AJAX handling and timeline rendering logic. The options parameter is processed through wpbc-ajax.php and reflected back into the response through the timeline class without proper sanitization or output escaping. Attackers can supply arbitrary payloads that the browser subsequently renders as executable script.
The attack requires user interaction, typically a victim clicking a malicious link. Successful exploitation runs script in the victim's session context, which enables session cookie theft, forced administrative actions, and injection of persistent backdoors when the victim is an administrator.
Root Cause
The root cause is insufficient input sanitization and missing output escaping for the options parameter in the timeline rendering functions located in core/timeline/v2/wpbc-class-timeline_v2.php. The vulnerable sinks appear at multiple lines in the class including line 593, line 919, and line 3385.
The plugin ships with the booking_is_nonce_at_front_end option disabled by default. This removes the nonce verification step, allowing unauthenticated requests to reach the vulnerable code path without any anti-CSRF protection.
Attack Vector
The attack is network-based and requires no authentication. An attacker crafts a URL containing a malicious options parameter payload and delivers it to a target through phishing, forum posts, or malicious advertising. When the victim clicks the link, the payload is reflected into the response and executed by the victim's browser.
Because the vulnerability produces a scope change in browser context, the injected script can interact with content and cookies belonging to the WordPress site. Targeting an authenticated administrator can lead to full site compromise.
The vulnerability mechanism is described in the Wordfence Vulnerability Analysis and the vulnerable code paths are visible in the WordPress Booking Plugin Code.
Detection Methods for CVE-2026-92561
Indicators of Compromise
- HTTP requests to WordPress AJAX endpoints containing options parameter values with encoded <script>, javascript:, or event handler payloads such as onerror= and onload=.
- Referrer headers pointing to unfamiliar external domains preceding sudden administrative configuration changes.
- Unexpected creation of WordPress administrator accounts or plugin installations shortly after user interaction with unusual URLs.
Detection Strategies
- Inspect web server access logs for requests to wpbc-ajax.php containing suspicious characters or HTML entities in the options query parameter.
- Deploy web application firewall rules that block URL parameters containing script tags, JavaScript URI schemes, or common XSS payload patterns targeting the Booking Calendar plugin.
- Correlate outbound browser requests from authenticated administrator sessions with recently visited external links to identify potential exploitation chains.
Monitoring Recommendations
- Alert on modifications to WordPress user roles, plugin files, and administrator email addresses that occur without corresponding legitimate admin activity.
- Monitor DOM-based error telemetry from client-side logging for script execution originating in Booking Calendar plugin response pages.
- Track deployed plugin versions across managed WordPress instances and flag any host still running Booking Calendar 11.8.2 or earlier.
How to Mitigate CVE-2026-92561
Immediate Actions Required
- Update the Booking Calendar plugin to the version published in the WordPress Booking Changeset that addresses the reflected XSS.
- Enable the booking_is_nonce_at_front_end option in the plugin configuration to restore nonce verification on front-end AJAX requests.
- Audit administrator accounts, active sessions, and recently installed plugins for signs of unauthorized modification.
Patch Information
The vendor released a fix referenced in the WordPress Booking Changeset. Site owners should upgrade beyond version 11.8.2 and verify that the patched files replace the vulnerable functions in core/lib/wpbc-ajax.php and core/timeline/v2/wpbc-class-timeline_v2.php.
Workarounds
- Enable the booking_is_nonce_at_front_end setting to require nonce verification and block unauthenticated exploitation attempts.
- Deploy a web application firewall rule that inspects the options parameter for HTML tags, JavaScript URI schemes, and event handler attributes.
- Restrict access to WordPress AJAX endpoints from untrusted networks where the Booking Calendar plugin is not required for public use.
- Apply a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit the impact of reflected payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
