CVE-2026-109147
WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
| Vendor | unknown |
| Product | wp booking system |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp booking system
Be the first to know when new unknown vulnerabilities affecting unknown wp booking system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Booking System
0 < 2.1.0.3
References
Credits
Zahid Abbasi WPScan