Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88825

iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88825

Published

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88825

Published

iGMS Direct Booking

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "iGMS Direct Booking",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "2.0"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON