CVE-2026-93655: WordPress Booking Calendar Plugin XSS Flaw

CVE-2026-93655 Overview

CVE-2026-93655 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Booking Calendar plugin for WordPress. The flaw affects all versions up to and including 11.8.3. It stems from insufficient input sanitization and output escaping of the wpbc_auto_fill parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. Successful exploitation can lead to session theft, account takeover, or unauthorized actions performed in the context of the targeted user. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser through a crafted link, enabling session hijacking and content manipulation on affected WordPress sites.

Affected Products

WordPress Booking Calendar plugin, all versions up to and including 11.8.3
WordPress sites that expose booking functionality via the vulnerable JavaScript handlers
Deployments serving the plugin assets wpbc_all.js and wpbc_time-selector.js

Discovery Timeline

2026-09-22 - CVE-2026-93655 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93655

Vulnerability Analysis

The Booking Calendar plugin processes the wpbc_auto_fill parameter through client-side JavaScript without applying sufficient sanitization or output encoding. Attacker-controlled input flows from the request into the DOM, where the browser interprets it as executable script. The vulnerable logic is present in wpbc_all.js around lines 3370 and 3396, and in wpbc_time-selector.js around line 87, according to the plugin source references. Because the payload is reflected rather than stored, exploitation requires a victim to load an attacker-crafted URL. User interaction is required, but no authentication is needed to weaponize the flaw.

Root Cause

The root cause is missing input sanitization and improper output escaping of the wpbc_auto_fill request parameter, classified as CWE-79: Improper Neutralization of Input During Web Page Generation. The plugin trusts request data when constructing DOM content, allowing HTML and script fragments to render verbatim.

Attack Vector

An attacker crafts a URL targeting a vulnerable WordPress site with a malicious payload in the wpbc_auto_fill parameter. The attacker delivers the link through phishing, forum posts, or social media. When a victim clicks the link, the plugin reflects the payload into the page and the browser executes it. Because the CVSS scope is changed, the injected script can affect resources beyond the vulnerable component, including cookies and DOM elements belonging to the parent site.

No verified proof-of-concept code has been published. See the Wordfence Vulnerability Intelligence entry and the plugin changeset for the vendor fix.

Detection Methods for CVE-2026-93655

Indicators of Compromise

HTTP requests containing the wpbc_auto_fill parameter with encoded HTML tags, <script> fragments, or javascript: URIs
Referer headers pointing to unfamiliar domains that forward users to booking pages with unusual query strings
Browser console errors or unexpected outbound requests originating from pages that render the Booking Calendar plugin
Unexpected session cookie transmissions to third-party hosts after a user visits a booking page

Detection Strategies

Inspect web server and WAF logs for wpbc_auto_fill parameter values containing angle brackets, event handlers such as onerror= or onload=, or URL-encoded script tags
Deploy signatures that flag reflected XSS patterns against WordPress endpoints serving the Booking Calendar plugin
Correlate suspicious inbound clicks with subsequent authenticated actions on the same session to identify post-exploitation activity

Monitoring Recommendations

Enable verbose access logging on WordPress endpoints and forward logs to a centralized analytics pipeline for query and alerting
Alert on anomalous parameter lengths or non-alphanumeric character distributions in wpbc_auto_fill values
Monitor administrator account activity for signs of session hijacking following visits to booking pages

How to Mitigate CVE-2026-93655

Immediate Actions Required

Upgrade the Booking Calendar plugin to a version released after 11.8.3 that includes the vendor fix referenced in the plugin changeset
Audit web server logs for prior requests containing suspicious wpbc_auto_fill values and investigate any matches
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found

Patch Information

The vendor addressed the issue in a subsequent release, as documented in the WordPress Booking Plugin changeset. Administrators should apply the update through the WordPress plugin management console or via WP-CLI. Confirm the installed version is newer than 11.8.3 after the update.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests containing HTML or script metacharacters in the wpbc_auto_fill parameter
Restrict access to booking pages using authentication or IP allowlisting until the plugin is patched
Set a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected XSS payloads

bash

# Example NGINX rule to block suspicious wpbc_auto_fill values
if ($arg_wpbc_auto_fill ~* "(<|>|script|onerror|onload|javascript:)") {
    return 403;
}