CVE-2026-92561

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 11.8.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and executed in the victim's browser. This occurs via the options parameter. The issue is exacerbated because the booking is nonce at front end option is disabled by default, bypassing the nonce check—a security mechanism used to protect against cross-site request forgery—and allowing requests to reach the vulnerable sink without verification.

Recommendations Update to version 11.8.3 or later. Enable the booking is nonce at front end option to ensure nonce verification is active.