rootpwn

critical · CVSS v3 8.8 · EPSS 0.00172

CVE-2026-88825

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowin…

Description

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.

Scores

Severity
critical
CVSS v2
10
CVSS v3
8.8
CVSS v4
—
EPSS
0.00172

← All CVEs

Related CVEs

critical

CVE-2026-93467

CVE-2026-93467 is an insecure deserialization flaw in OAKlouds by HGiga. Unauthenticated attackers can send crafted data to trigger arbitrary code execution on the server, allowing full compromise of the affected services.

View analysis

critical

CVE-2026-17086

The ShortPixel Image Optimizer plugin for WordPress contains a PHP Object Injection vulnerability in versions up to and including 6.5.5. It arises from the unsafe deserialization of untrusted input accessible to authenticated users with author-level privileges and above. While no native POP chain exists in the plugin itself, the presence of a compatible gadget chain from another theme or plugin could enable arbitrary file deletion, data retrieval, or code execution.

View analysis

critical

CVE-2026-81810

The All-in-One WP Migration and Backup plugin for WordPress fails to enforce proper capability checks on multiple AJAX actions. This oversight allows users with export privileges to import arbitrary site archives and escalate privileges to administrator under specific misconfigurations.

View analysis

critical

CVE-2026-85123

The Easy Form Builder plugin for WordPress fails to properly validate submitted values against stored configurations for certain form types. This oversight allows unauthenticated attackers to create unauthorized WordPress accounts on target sites where user registration has been explicitly disabled by the administrator. The flaw undermines core site access controls and exposes the installation to potential administrative takeover.

View analysis