Stored Cross-Site Scripting Vulnerability in Tennis Court Bookings Plugin for WordPress

CVE-2026-1044

What is CVE-2026-1044?

The Tennis Court Bookings plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in its admin settings. Authenticated attackers with administrator-level access can potentially inject arbitrary web scripts that execute when other users visit affected pages. This vulnerability is particularly concerning for multi-site installations and configurations where unfiltered_html is disabled, as it opens avenues for malicious script executions across the site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References