CVE-2026-8143

Name of the Vulnerable Software and Affected Versions HBook plugin for WordPress versions prior to 2.2.0

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the hb country iso, hb usa state iso, and hb canada province iso parameters, enabling the injection of arbitrary web scripts that execute when a user accesses the HBook Customers admin page.

Recommendations Update the plugin to a version newer than 2.1.9.