Security
Loading…

CVE-2026-88825

HIGHCVSS 8.8
View on NVD← Back to search
Description

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.

Timeline
Published:September 18th, 2026 6:16 AM
Last modified:September 18th, 2026 7:08 PM
CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)
CWE-79
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute