Description

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T07:16:56.880Z",
  "pubdate": "2026-09-25T07:16:56.880Z",
  "executiveSummary": "The BA Book Everything plugin for WordPress, in versions up to and including 1.8.27, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from inadequate input sanitization and output escaping within the 'first_name' parameter, which is processed during the booking flow.\nThis vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads into the plugin's booking data. When an administrator or authorized user accesses the affected booking details, the injected scripts execute within their browser context.\nThe exploit chain is particularly critical because it requires no authentication. An attacker can autonomously obtain the necessary order credentials—specifically order_id, order_num, and order_hash—by submitting a guest booking through the public-facing [babe-booking-form] shortcode. This accessibility enables remote attackers to compromise the integrity of administrative sessions or steal sensitive cookies and session tokens.\nGiven the nature of Stored XSS, the impact extends to the potential full takeover of administrative accounts, unauthorized redirection, or the modification of site content. Immediate remediation is required to mitigate the risk of account compromise and unauthorized access to site management interfaces.",
  "technicalDetails": "The vulnerability resides in the handling of booking submission parameters within the BA Book Everything plugin. Specifically, the 'first_name' parameter is passed to the application backend without sufficient sanitization or proper context-aware output escaping. This failure to neutralize malicious input allows for the injection of arbitrary HTML and JavaScript code into the persistent storage layer of the WordPress database.\nThe attack flow is initiated via the public [babe-booking-form] shortcode. An unauthenticated attacker leverages the form to submit a request, populating the 'first_name' field with a crafted XSS payload. Because the plugin does not implement strict validation on this input, the payload is successfully stored in the booking records.\nTo reach the vulnerable action_to_pay() handler, an attacker must acquire specific order identifiers. The plugin's architecture allows an unauthenticated user to finalize a guest booking, which subsequently generates a unique order_id, order_num, and order_hash. These parameters are publicly accessible or returned as part of the initial booking flow, providing the attacker with the necessary components to manipulate the booking record effectively.\nOnce the malicious payload is stored, the vulnerability is triggered whenever an administrative user views the booking details via the WordPress backend. The application retrieves the unsanitized booking data and renders it directly into the HTML document object model (DOM). The injected script then executes within the context of the administrator’s session. This allows for post-exploitation activities including, but not limited to, the exfiltration of session cookies, the creation of new administrative accounts, or the injection of persistent malicious content into other parts of the website.\nThe scope of this vulnerability is widespread across all plugin versions up to and including 1.8.27. The lack of proper input filtering during the initial submission and the absence of output encoding during the rendering phase represent a fundamental security failure in the plugin's data processing lifecycle. Because the exploit relies on standard plugin functionality and does not require elevated privileges or pre-existing authentication, the barrier to exploitation is extremely low for remote adversaries targeting the WordPress installation."
}