WordPress BA Book Everything plugin <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin BA Book Everything versions = 1.8.28...

CVE-2026-102565

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-102565 BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-102565

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.28 . The root cause is insufficient input sanitization and output escaping within the 'booking_service_qty' parameter. An unauthenticated attacker can inject arbi...

EUVD-2026-91203

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-104098

Name of the Vulnerable Software and Affected Versions BA Book Everything versions prior to 1.8.29 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored ...

WordPress BA Book Everything plugin <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin BA Book Everything versions = 1.8.27...

CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.27 . The root cause is insufficient input sanitization and output escaping of the first_name parameter. This allows unauthenticated attackers to inject arbitrary ...

CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-86546

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96039: Improper Neutralization of Input During Web Page Generation

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-24371

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...

CVE-2026-24371

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...

CVE-2026-24371 WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...

CVE-2026-24371

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...

CVE-2026-24371

CVE-2026-24371 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin BA Book Everything (ba-book-everything) affecting versions up to 1.8.16. The RedHat/NVD entries describe an access-control weakness allowing exploitation via misconfigured security levels. The ...

CVE-2026-24371 WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...

CVE-2026-24371: Missing Authorization

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...