{"id":"CVE-2026-6910","aliases":["EUVD-2026-42528","GHSA-vvcw-jcq9-759q"],"status":"published","title":"Bookero.pl \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","description":"The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `\u003cscript\u003e` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00349,"percentile":0.28794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-07-09T06:52:52Z","modified":"2026-07-09T16:19:45Z","products":[{"vendor":"safistudio","product":"bookero.pl – system rezerwacji online"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd0e6ca6-f6a7-4e81-aea1-3b59de0173d6?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/bookeropl/trunk/libraries/bookero-front.php#L174"},{"url":"https://plugins.trac.wordpress.org/browser/bookeropl/tags/2.1/libraries/bookero-front.php#L174"},{"url":"https://plugins.trac.wordpress.org/browser/bookeropl/trunk/libraries/bookero-front.php#L173"},{"url":"https://plugins.trac.wordpress.org/browser/bookeropl/tags/2.1/libraries/bookero-front.php#L173"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3524452%40bookeropl\u0026new=3524452%40bookeropl"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6910"},{"url":"https://github.com/advisories/GHSA-vvcw-jcq9-759q"}],"sources":{"cve":[{"id":"CVE-2026-6910","title":"Bookero.pl \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","description":"The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `\u003cscript\u003e` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.","status":"published","published":"2026-07-09T06:52:52.056Z","modified":"2026-07-09T14:39:45.983Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-42528","description":"The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `\u003cscript\u003e` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.","status":"published","published":"2026-07-09T06:52:52Z","modified":"2026-07-09T14:39:45Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:04.126011Z"}],"ghsa":[{"id":"GHSA-vvcw-jcq9-759q","title":"The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site...","description":"The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `\u003cscript\u003e` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.","status":"published","published":"2026-07-09T09:30:29Z","modified":"2026-07-09T09:30:40Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:20.981798Z"}],"nvd":[{"id":"CVE-2026-6910","description":"The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `\u003cscript\u003e` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.","status":"published","published":"2026-07-09T08:16:49.21Z","modified":"2026-07-09T16:19:45.567Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:28.4135Z"}]}}