Description

Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T12:16:36.437Z",
  "pubdate": "2026-08-20T12:16:36.437Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the WP BASE Booking plugin versions 6.3.2 and prior, allowing authenticated users with subscriber-level privileges to inject malicious scripts into the application. This vulnerability arises from improper neutralization of user-supplied input before rendering it back to the user, exposing the web application to persistent or reflected script execution contexts. The primary impact of this security flaw includes session hijacking, unauthorized actions performed on behalf of other users, credential theft, and potential defacement or redirection of the affected site. The risk implication is moderate to high, depending on the privileges of the interacting victim, particularly if administrators fall prey to the injected payload. Exploitation requires authenticated access with at least subscriber-level privileges within the WordPress environment, meaning an attacker must first provision or compromise a low-privilege user account. No complex social engineering is strictly required beyond inducing a victim or administrator to view the affected administrative or front-end interface where the malicious payload renders. Remediation requires updating the WP BASE Booking plugin beyond version 6.3.2 or applying input sanitization and output encoding controls to all vulnerable parameters.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw residing within the WP BASE Booking plugin for WordPress, specifically affecting versions 6.3.2 and prior. The root cause stems from insufficient validation, sanitization, and output encoding of user-supplied parameters processed by the plugin handlers. When a user with subscriber-level privileges submits malicious input containing executable JavaScript or HTML tags, the application stores or reflects the input without proper escaping.\nThe attack flow begins with the authentication of an attacker possessing subscriber-level privileges on the target WordPress installation. The attacker interacts with vulnerable input fields or HTTP request parameters exposed by the WP BASE Booking plugin. By crafting a malicious payload containing script tags or event handlers (such as onload or onerror), the attacker submits the request to the server. The application processes the request and incorporates the unescaped payload into the Document Object Model (DOM) of the affected web page.\nWhen an unsuspecting user, such as a high-privileged administrator, navigates to the compromised page, the browser parses and executes the injected script within the context of the victim's session. Because the execution occurs locally in the victim's browser, the payload inherits the session cookies, anti-CSRF tokens, and access rights of the victim. This enables post-exploitation activities such as making unauthorized REST API requests, creating rogue administrative accounts, or modifying plugin configurations to establish persistent access. The vulnerability exposes the application over standard web protocols (HTTP/HTTPS) and requires network access to the WordPress site alongside authenticated subscriber credentials."
}