---
id: CVE-2026-103305
title: >-
  The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation
  and CSRF checks when saving its settings, and does not escape some of them
  when outputting them, allowing unauthenticated users to perform Stored
  Cross-Site Scri…
summary: >-
  The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation
  and CSRF checks when saving its settings, and does not escape some of them
  when outputting them, allowing unauthenticated users to perform Stored
  Cross-Site Scri…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:16:50.873'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103305'
references:
  - url: 'https://wpscan.com/vulnerability/9fde6498-7d23-4419-9416-d5f50ca97c4a/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.706Z'
epss: 0.00125
epssPercentile: 0.01986
---

## Overview

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.