https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:21:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342412 EUVD-2026-342412 https://cve.radiocsirt.org/vuln/euvd-2026-342412 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8791 <p>The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option(&#39;trafft_option&#39;, [&#39;bookingWebsiteUrl&#39; =&gt; ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `&lt;bookingWebsiteUrl&gt;/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).</p> <p>The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option(&#39;trafft_option&#39;, [&#39;bookingWebsiteUrl&#39; =&gt; ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `&lt;bookingWebsiteUrl&gt;/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-8791 https://cve.radiocsirt.org/vuln/ghsa-xr8c-xpp9-8m4h <p>The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option(&#39;trafft_option&#39;, [&#39;bookingWebsiteUrl&#39; =&gt; ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `&lt;bookingWebsiteUrl&gt;/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).</p> <p>The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option(&#39;trafft_option&#39;, [&#39;bookingWebsiteUrl&#39; =&gt; ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `&lt;bookingWebsiteUrl&gt;/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins).</p> https://cve.radiocsirt.org/vuln/ghsa-xr8c-xpp9-8m4h