CVE-2026-1044

The Tennis Court Bookings plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings. It originates from insufficient input sanitization and output escaping, present in all versions up to and including 1.2.7 [1]. This flaw allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that execute whenever a user accesses an affected page [1].

Exploitation requires authentication and administrator-level access. The vulnerability only affects multi-site installations or environments where the unfiltered_html capability has been disabled [1]. Under these configurations, administrators can store malicious scripts in plugin settings that later execute for other users viewing those pages.

An attacker who exploits this vulnerability can perform actions such as session hijacking, defacement, or redirecting users to malicious sites, depending on the injected script [1]. Successful attacks compromise the integrity and confidentiality of the WordPress installation.

The plugin has been closed as of February 17, 2026 due to this security issue and is no longer available for download [1]. Users are advised to remove or replace the plugin to mitigate risk, as no patched version is provided [1].