CVE-2026-102565

Name of the Vulnerable Software and Affected Versions BA Book Everything versions prior to 1.8.29

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the booking service qty parameter. Exploitation is triggered when an administrator or privileged user views the injected order record within the wp-admin order management area during the standard order-review workflow.

Recommendations Update BA Book Everything to version 1.8.29 or later.