CVE-2026-88825

The iGMS Direct Booking WordPress plugin before version 2.0 is vulnerable to unauthenticated stored cross-site scripting (XSS) due to missing authorization and output escaping on its widget appearance settings. An attacker with no prior access can inject arbitrary web scripts that execute in the ...