{"id":"CVE-2026-8791","aliases":["EUVD-2026-50273","GHSA-xr8c-xpp9-8m4h"],"status":"published","title":"Booking System Trafft \u003c= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting","description":"The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option('trafft_option', ['bookingWebsiteUrl' =\u003e ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `\u003cbookingWebsiteUrl\u003e/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00419,"percentile":0.36512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-07-29T09:31:15Z","modified":"2026-07-30T14:01:30Z","products":[{"vendor":"ameliabooking","product":"booking system trafft"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93060cf-2df3-4d45-a1f2-304f443d58bc?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/trunk/trafft.php#L139"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php#L139"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/trunk/trafft.php#L155"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php#L155"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/trunk/trafft.php#L176"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php#L176"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/trunk/trafft.php#L325"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php#L325"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/trunk/trafft.php#L354"},{"url":"https://plugins.trac.wordpress.org/browser/booking-system-trafft/tags/1.0.17/trafft.php#L354"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8791"},{"url":"https://github.com/advisories/GHSA-xr8c-xpp9-8m4h"}],"sources":{"cve":[{"id":"CVE-2026-8791","title":"Booking System Trafft \u003c= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting","description":"The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option('trafft_option', ['bookingWebsiteUrl' =\u003e ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `\u003cbookingWebsiteUrl\u003e/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).","status":"published","published":"2026-07-29T09:31:15.606Z","modified":"2026-07-29T15:22:28.952Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-50273","description":"The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option('trafft_option', ['bookingWebsiteUrl' =\u003e ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `\u003cbookingWebsiteUrl\u003e/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).","status":"published","published":"2026-07-29T09:31:15Z","modified":"2026-07-29T15:22:28Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:29.807737Z"}],"ghsa":[{"id":"GHSA-xr8c-xpp9-8m4h","title":"The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...","description":"The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option('trafft_option', ['bookingWebsiteUrl' =\u003e ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `\u003cbookingWebsiteUrl\u003e/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).","status":"published","published":"2026-07-29T12:31:24Z","modified":"2026-07-29T12:31:31Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:54.335538Z"}],"nvd":[{"id":"CVE-2026-8791","description":"The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option('trafft_option', ['bookingWebsiteUrl' =\u003e ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `\u003cbookingWebsiteUrl\u003e/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).","status":"published","published":"2026-07-29T11:16:50.69Z","modified":"2026-07-30T14:01:30.413Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:33.629616Z"}]}}