CVE-2026-1945
Published: 04 March 2026
Summary
CVE-2026-1945 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-1945 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the WPBookit plugin for WordPress. It affects all versions up to and including 1.0.8 due to insufficient input sanitization and output escaping of the 'wpb_user_name' and 'wpb_user_email' parameters. This allows arbitrary web scripts to be injected into pages.
Unauthenticated attackers can exploit the vulnerability over the network (AV:N) with low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N). Exploitation changes the security scope (S:C) and enables injected scripts to execute whenever any user accesses the affected page, resulting in low impacts to confidentiality and integrity (C:L/I:L) but no availability impact (A:N), for an overall CVSS v3.1 score of 7.2.
Advisories and references, including Wordfence threat intelligence and WordPress plugin trac browser links, highlight the issue in the WPBookit booking shortcode controller at line 534 in both the 1.0.8 tag and trunk versions, along with a specific changeset in the repository, indicating locations for potential mitigation through code fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9351
Vulnerability details
The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb_user_name' and 'wpb_user_email' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
more
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables exploitation of a web application vulnerability for script injection and execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as wpb_user_name and wpb_user_email before they are stored or rendered.
Requires output filtering/escaping of stored values so that injected scripts cannot execute when pages are rendered to users.
Can block or alert on malicious script payloads introduced through the vulnerable booking parameters.