CVE-2026-96039

Name of the Vulnerable Software and Affected Versions BA Book Everything versions prior to 1.8.28

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server and executed in the browser of users who visit the affected page. The issue exists in the action to pay() handler via the first name parameter. An attacker can trigger this by placing a guest booking through the [babe-booking-form] shortcode to obtain the necessary order id, order num, and order hash credentials.

Recommendations Update to a version newer than 1.8.27. As a temporary mitigation, restrict access to the action to pay() handler or avoid using the first name parameter in the affected process until the update is applied.