CVE-2026-6910: Bookero.pl WordPress Plugin Stored XSS Vulnerability in Shortcode Attributes

Technical summary

The vulnerability resides in the `bookero_products()` function within the Bookero.pl WordPress plugin. The `hide_products` and `filter_products` shortcode attributes are concatenated directly into inline `<script>` blocks without sanitization or escaping. An authenticated attacker with contributor-level access can craft a shortcode containing JavaScript payload in these attributes. Because the raw input is embedded into a script context, the payload executes unconditionally when the page loads. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical stored XSS weakness.

Business impact

Organizations using the Bookero.pl plugin on their WordPress booking sites face a material insider threat. Compromised pages can capture user credentials, redirect visitors to phishing sites, steal session tokens, or inject malware. Since the vulnerability requires authenticated access, the risk profile depends on contributor user management practices. For sites with loose role assignments or shared contributor accounts, the exposure is higher. Customer trust and data compliance obligations (GDPR, etc.) are at risk if user data is exfiltrated through injected scripts.

Affected systems

The Bookero.pl – system rezerwacji online WordPress plugin in versions up to and including 2.2 is affected. The vulnerability applies to any WordPress installation running this plugin where contributor-level users or administrators exist. The attack surface includes any page or post that uses the `bookero_products` shortcode with untrusted `hide_products` or `filter_products` attribute values.

Exploitability

Exploitation requires an authenticated WordPress account with contributor privileges or higher. No user interaction from the victim is required—the script executes automatically when the compromised page loads. The attack is reliable once a malicious shortcode is published. However, the requirement for authenticated access significantly limits the threat actor population compared to unauthenticated vulnerabilities. The vulnerability has not been designated as exploited in the wild (not listed in CISA KEV catalog).

Remediation

Update the Bookero.pl plugin to a patched version beyond 2.2. Verify against the vendor's security advisory for the exact patched version number. Immediately audit pages and posts using the `bookero_products` shortcode to ensure no malicious attributes have been injected. Review contributor user accounts and apply the principle of least privilege—restrict contributor role assignment to trusted personnel only. For high-risk installations, consider temporarily disabling the plugin until a patch is confirmed available and applied.

Patch guidance

Check the official Bookero.pl plugin repository or the vendor's security announcement for version 2.3 or later (exact version to be verified against vendor release notes). Standard WordPress plugin update mechanisms can be used once the patch is released. Test the update in a staging environment first to ensure compatibility with custom configurations and other plugins. After updating, inspect any pages previously using the affected shortcode to confirm no residual XSS payloads remain.

Detection guidance

Monitor WordPress admin logs and post revision history for unusual `bookero_products` shortcode attributes, particularly those containing JavaScript keywords (e.g., `script`, `on`, `eval`). Search the database and filesystem for shortcode instances with suspicious `hide_products` or `filter_products` parameter values. Web application firewalls can flag HTTP requests containing encoded XSS patterns sent to WordPress post/page edit endpoints. Consider deploying a WordPress security plugin that monitors shortcode modifications by lower-privileged users.

Why prioritize this

Although the CVSS score of 6.4 is moderate, the attack requires authenticated access, which narrows immediate risk. However, internal threats and compromised accounts are real concerns, particularly in multi-author WordPress sites. Organizations with strict contributor access controls and security awareness training can safely defer patching beyond critical items. Those with permissive role assignments or shared accounts should prioritize this higher. The lack of public exploit activity provides some breathing room for coordinated patching.

Risk score, explained

The CVSS v3.1 score of 6.4 (MEDIUM) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low-privilege authentication (PR:L), no user interaction needed (UI:N), and scope change (S:C) affecting resources beyond the vulnerable component. Integrity and confidentiality impacts (I:L, C:L) acknowledge that injected scripts can steal data or deface content. Availability is not impacted (A:N). The authentication requirement prevents a higher severity rating despite the reliable exploitability.

Frequently asked questions