WordPress BA Book Everything Plugin Stored XSS Flaw

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The BA Book Everything WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.8.27, stemming from insufficient input sanitization on the first_name parameter. Unauthenticated attackers can inject malicious scripts that persist in the database and execute whenever users access affected pages, potentially compromising user sessions, stealing credentials, or redirecting visitors to malicious sites. This vulnerability affects any WordPress installation using this booking plugin, making it a significant risk for service-based businesses relying on the plugin for reservations and client management.

Casky's 323 matching security skills leverage Claude AI's extended reasoning to detect this attack pattern across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance - Gather Victim Identity Information). Practitioners using Casky would identify detection signals including: parameter tampering on form submissions, unusual base64 or JavaScript encoding in database values, DOM manipulation patterns in page source, and cookies being accessed by injected scripts. The platform's skills map input validation failures (CWE-79) to reconnaissance activities where attackers probe for XSS entry points, then lateral movement through stored payload execution. Security teams would see alerts flagging unescaped user input flowing into HTML contexts, stored JavaScript signatures in database queries, and behavioral indicators of session hijacking following page access—enabling rapid isolation and remediation before widespread exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-96039.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-96039

Casky has 323 skills that investigate the attack patterns behind CVE-2026-96039. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn