Booking System Trafft Vulnerabilities

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler ve...

CVSS:

6.4

Affected:

up to 1.0.17

Fixed in:

1.0.18

Disclosed:

Jul 28, 2026

CVE-2026-8791 on NVD →

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 1.0.14

Fixed in:

1.0.15

Disclosed:

Aug 27, 2025

CVE-2025-58213 on NVD →

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trafftbooking' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, w...

CVSS:

6.4

Affected:

up to 1.0.6

Fixed in:

1.0.7

Disclosed:

Dec 12, 2024

CVE-2024-11754 on NVD →