CVE-2026-92561 Details

A reflected cross-site scripting vulnerability has been identified in the Booking Calendar plugin for WordPress, affecting all versions up to and including 11.8.2. The vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts would execute if the attacker successfully convinced a user to perform a specific action, such as clicking a link. Additionally, the nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option is disabled, enabling unauthenticated requests to access the vulnerable code without verification.