CVE-2026-88825CWE-79cross-site-scripting

CVE-2026-88825

High · published September 18, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00505 · 42.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-18T10:16Z
References (1)
https://wpscan.com/vulnerability/12337af6-e465-4010-a54d-be92a5dfa5d6/ · [email protected]
EPSS history
Timeline
  • 19 SEP 03:54Z
    EPSS moved — → 0%
    epss
  • 18 SEP 06:00Z
    iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings
    cvelistv5