CVE-2026-28040

BRIEFING NOTE: CVE-2026-28040 CVE-2026-28040 is a Stored Cross-Site Scripting (XSS) vulnerability in Magepeople inc.'s Taxi Booking Manager for WooCommerce plugin, affecting versions through 2.0.0. The vulnerability stems from improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts that persist in the application. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and low privileges. The attack requires user interaction to trigger the stored XSS payload and impacts confidentiality, integrity, and availability of the affected system. The FAUCET Risk Score of 35.0/100 indicates moderate organizational risk. There is currently no evidence of active exploitation in the wild, with an EPSS score of 0.00033 indicating minimal practical exploitation likelihood. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and appears to have minimal community attention. However, organizations running the affected Taxi Booking Manager plugin versions should prioritize updating to mitigated releases as a preventive measure.