Description

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-22T06:16:49.893Z",
  "pubdate": "2026-09-22T06:16:49.893Z",
  "executiveSummary": "The Booking Calendar plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw exists in versions up to and including 11.8.3. The vulnerability stems from improper handling of user-supplied input via the 'wpbc_auto_fill' parameter.\nBy successfully injecting malicious scripts into this parameter, an unauthenticated attacker can execute arbitrary JavaScript in the context of an unsuspecting user's browser session. This vulnerability poses a significant risk to the integrity and confidentiality of the user's session data. Successful exploitation requires an attacker to convince a user to interact with a crafted link, typically through social engineering. If successful, the attacker can perform unauthorized actions on behalf of the user, potentially compromising administrative accounts if an administrator is targeted.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Booking Calendar plugin to properly sanitize input provided to the 'wpbc_auto_fill' parameter and the subsequent failure to escape that output before rendering it in the HTML response. This creates an entry point for reflected script injection.\nThe attack flow begins when an attacker identifies a URL pointing to the vulnerable WordPress installation that utilizes the 'wpbc_auto_fill' parameter. The attacker crafts a malicious payload—typically containing JavaScript—and encodes it into the 'wpbc_auto_fill' parameter of the target URL. When a legitimate, authenticated user clicks this crafted link, the server processes the request and reflects the unsanitized input directly into the generated HTML page.\nBecause the application does not implement adequate output escaping, the victim's browser interprets the injected payload as executable code rather than plain text. Consequently, the script executes within the security context of the victim's session. Since the exploit does not require authentication from the attacker, it is classified as an unauthenticated attack vector. The impact is dictated by the privileges of the victim; for instance, if an administrator executes the script, the attacker could theoretically perform administrative actions, modify plugin settings, create new users, or extract session cookies to facilitate session hijacking. This vulnerability effectively bypasses the application's intended input handling logic, allowing for the delivery of malicious content through legitimate plugin functionality."
}