CVE-2026-103305 PUBLISHED

Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

Assigner: WPScan
Reserved: 30.09.2026 Published: 11.10.2026 Updated: 11.10.2026

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.

Product Status

Vendor Unknown
Product Prenotazioni
Versions Default: unknown
  • affected from 0 to 1.7.5 (incl.)

Credits

  • Enrico Marcolini finder
  • Claudio Marchesini finder
  • Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE
  • CWE-352 Cross-Site Request Forgery (CSRF) CWE