CVE-2026-93655

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 11.8.4

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script via the wpbc auto fill parameter, which then executes in the user's browser.

Recommendations Update Booking Calendar to version 11.8.4 or later. Avoid using the wpbc auto fill parameter until the plugin is updated.