CVE-2026-66687

This stored XSS in WpBookingly is worth treating as a category warning, not a one-off incident. The vulnerability lives in the public booking interface — any anonymous user can inject payload through customer input fields — and it executes when staff review those bookings in the admin panel. That's a significant asymmetry the CVSS 6.5 score flattens: you're not just hitting a form, you're compromising whoever processes bookings. The economic reality behind this is worth internalizing. Booking plugins are data pipelines: customer input goes in, gets stored, then renders back across admin dashboards, confirmation emails, calendar views, and export functions. Each render point is a potential XSS sink, and small-team or solo WordPress plugin maintainers routinely miss one while getting others right. That's not incompetence — it's the predictable outcome of optimizing for features and compatibility while security gets deferred. Two things should concern you beyond the CVE itself. First, check whether the fix was surgical — one render path patched — or architectural, with the entire data-to-output pipeline audited. If it's the former, assume other render paths remain unsafe. Second, map your own installation: the admin view nobody checks, the CSV export for accounting, the REST endpoint feeding a mobile app, that deprecated booking form that still ships with the plugin. These are the sediment layers where unpatched vectors accumulate. The clustering pattern in WordPress plugin XSS is well-documented. A plugin gets one CVE, earns scrutiny, and typically generates two to four follow-on disclosures within twelve months as researchers systematically audit render paths the original report didn't touch. This is probably chapter two of a longer disclosure sequence. Your real exposure isn't just the named vector — it's the temporal window between patch release and full remediation across your deployment, and the spatial gap between the one reported sink and the half-dozen render paths nobody remembered to test. Assume both are wider than the CVE suggests.

Reviewed through automated stages and approved by a human before publication.