CVE-2026-1607

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1607", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-29T12:02:02.217Z", "datePublished": "2026-04-14T03:37:32.795Z", "dateUpdated": "2026-04-14T13:18:48.779Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-14T03:37:32.795Z"}, "affected": [{"vendor": "surbma", "product": "Surbma | Booking.com Shortcode", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `surbma-bookingcom` shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/01280afb-4745-4f36-823e-ed794bb3353a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/surbma-bookingcom-shortcode/tags/2.0/surbma-bookingcom-shortcode.php#L34"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2026-01-03T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-06T11:21:34.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-13T14:39:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T13:18:32.957479Z", "id": "CVE-2026-1607", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:18:48.779Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1607", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T13:18:32.957479Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:18:44.866Z"}}], "cna": {"title": "Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "surbma", "product": "Surbma | Booking.com Shortcode", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-03T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-06T11:21:34.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-13T14:39:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/01280afb-4745-4f36-823e-ed794bb3353a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/surbma-bookingcom-shortcode/tags/2.0/surbma-bookingcom-shortcode.php#L34"}], "descriptions": [{"lang": "en", "value": "The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `surbma-bookingcom` shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-14T03:37:32.795Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1607", "state": "PUBLISHED", "dateUpdated": "2026-04-14T13:18:48.779Z", "dateReserved": "2026-01-29T12:02:02.217Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-14T03:37:32.795Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Surbma | Booking.com Shortcode", "vendor": "surbma", "versions": [{"lessThanOrEqual": "2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `surbma-bookingcom` shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-1607", "lastModified": "2026-06-17T10:16:09.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1607", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T13:18:32.957479Z", "version": "2.0.3"}}]}, "published": "2026-04-14T04:17:00.163", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/surbma-bookingcom-shortcode/tags/2.0/surbma-bookingcom-shortcode.php#L34"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/01280afb-4745-4f36-823e-ed794bb3353a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Surbma | Booking.com Shortcode", "source": "cna", "vendor": "surbma"}, "product": "surbma_|_booking.com_shortcode", "vendor": "surbma"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-14T06:20:38.603185+00:00", "value": {"mitigation_remediation": ["Update the Surbma | Booking.com Shortcode plugin to the latest version that removes the XSS flaw.", "If an update cannot be applied, permanently delete the plugin from the WordPress installation to eliminate the vulnerable code path.", "Restrict the number of users granted contributor or higher permissions to only those who truly require it, thereby narrowing the attack surface.", "Regularly update WordPress core and security plugins to reduce overall exposure to similar vulnerabilities."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting via shortcode that allows authenticated contributors or higher to inject JavaScript into pages"}, "threat_synthesis": {"affected_systems": "All releases of the Surbma | Booking.com Shortcode plugin from the first version up to and including version 2.1 are affected. The vulnerability is limited to sites running WordPress with this plugin installed and that provide contributor\u2011level or higher user roles to any account. Core WordPress and other plugins are not impacted.", "description_and_impact": "The Surbma | Booking.com Shortcode plugin contains a stored cross\u2011site scripting flaw (CWE\u201179) caused by insufficient sanitization of user\u2011supplied attributes in the surbma\u2011bookingcom shortcode. An authenticated user with contributor or higher privileges can embed arbitrary JavaScript that will run in the browser of any visitor who views a page containing the shortcode. The injected code executes within the site\u2019s context and can perform any action allowed by the victim\u2019s session, potentially leading to data theft, session hijacking or defacement.", "risk_and_exploitability": "The CVSS score of 6.4 denotes a moderate severity. Because the flaw requires authenticated contributor or higher access, it is not exploitable by unauthenticated attackers. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack path involves an attacker using the WordPress content editor to edit a post or page, inserting malicious attributes into the shortcode, which then causes the script to execute when other users load the page."}}}}, "created": "2026-04-14T16:15:55.860252+00:00", "updated": "2026-04-14T16:30:52.463967+00:00", "vendors": ["surbma", "surbma$PRODUCT$surbma_|_booking.com_shortcode", "wordpress", "wordpress$PRODUCT$wordpress"]}