Stored Cross-Site Scripting Vulnerability in BA Book Everything for WordPress

CVE-2026-96039

What is CVE-2026-96039?

The BA Book Everything plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'first_name' parameter. This vulnerability arises from inadequate input sanitization and output escaping, allowing attackers to inject arbitrary scripts into pages. Unauthenticated individuals can exploit this flaw by submitting a guest booking, subsequently executing malicious scripts whenever a user accesses the affected pages. This exploit enables attackers to retrieve sensitive credentials required for actions within the plugin, further amplifying the risk of unauthorized access.

References