What’s Vulnerable › Vulnerabilities
CVE-2026-88825: iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-18 · updated 2026-09-18
- Weakness: CWE-79
Description
The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.
Affected products
- iGMS Direct Booking: before 2.0 — fixed in 2.0
How to fix
Upgrade to a fixed version: iGMS Direct Booking 2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-88825 or the next vulnerability affects your stack