CVE-2026-1607

OVERVIEW: CVE-2026-1607 is a Stored Cross-Site Scripting (XSS) vulnerability in the Surbma | Booking.com Shortcode WordPress plugin affecting all versions through 2.1. The vulnerability exists in the plugin's surbma-bookingcom shortcode due to insufficient input sanitization and output escaping of user-supplied attributes, allowing malicious scripts to be permanently stored and executed in page content. SEVERITY: This vulnerability carries a CVSS v3.1 score of 6.4 (MEDIUM) with a network-based attack vector requiring low complexity and valid user authentication at the contributor level or above. The scope is changed, with low impact to confidentiality and integrity. The FAUCET Risk Score of 35.0/100 reflects moderate concern, though the EPSS score of 0.0003 indicates relatively low probability of exploitation in the wild compared to other known vulnerabilities. EXPLOITATION STATUS: There is currently no evidence of active exploitation, as the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and is inactive on security community hot lists. However, the straightforward nature of stored XSS vulnerabilities and the requirement for only contributor-level access present meaningful risk for WordPress installations with lax user access controls, particularly those with multiple content creators or compromised user accounts.