What’s Vulnerable › Vulnerabilities
CVE-2026-103305: Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-11 · updated 2026-10-13
- Weakness: CWE-79
Description
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.
Affected products
- Prenotazioni: through 1.7.5
References
Get alerted when CVE-2026-103305 or the next vulnerability affects your stack