Stored Cross-Site Scripting Vulnerability in Booking System Trafft Plugin for WordPress

CVE-2026-8791

What is CVE-2026-8791?

The Booking System Trafft plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through the bookingWebsiteUrl setting. This issue arises from a lack of capability checks in the set_options AJAX action while the plugin is in agency mode. The nonce verification present within the trafftSetOptions() handler is accessible to any authenticated user, as it is printed on administrative pages. However, without proper capability checks, an attacker with Subscriber-level permissions or above can manipulate the update_option function to inject malicious scripts. The compromised setting then affects users by loading an attacker-controlled script on all front-end pages that utilize the booking shortcode, posing significant security risks to site visitors, including administrators.

References