Cross-Site Scripting Vulnerability in BookIt Plugin by Liquid Web
CVE-2026-125828

7.1HIGH

Key Information:

Vendor

WordPress
Status
Bookit
Vendor
CVE Published:
15 November 2026

What is CVE-2026-125828?

The Liquid Web BookIt plugin is susceptible to a stored Cross-Site Scripting (XSS) vulnerability, which occurs due to improper neutralization of user input during web page generation. This flaw could allow an attacker to inject malicious scripts into webpages viewed by users, leading to potential data theft and unauthorized actions in the context of the user's session. This vulnerability affects versions of BookIt up to 2.6.0.7, posing a significant security risk to users who have not applied necessary updates.

Affected Version(s)

BookIt 0 <= 2.6.0.7

References

https://patchstack.com/database/wordpress/plugin/bookit/v...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

KAIS0ps | Patchstack Bug Bounty Program
.