CVE-2026-6910
Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `<script>` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.
| CWE | CWE-79 |
| Vendor | safistudio |
| Product | bookero.pl – system rezerwacji online |
| Published | Jul 9, 2026 |
| Last Updated | Jul 9, 2026 |
Get instant alerts for safistudio bookero.pl – system rezerwacji online
Be the first to know when new medium vulnerabilities affecting safistudio bookero.pl – system rezerwacji online are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N