high8.8
CVE-2026-103305
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when out…
Impact
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.
Affected products
| Product | Affected versions |
|---|---|
| Prenotazioni WordPress Plugin | through 1.7.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.