Prenotazioni WordPress plugin: Unauthenticated stored XSS via settings
Summary
The Prenotazioni WordPress plugin up to and including version 1.7.5 lacks authorisation and CSRF checks when saving its settings and does not escape some of these settings on output. An unauthenticated attacker can therefore store malicious scripts that run in the browsers of administrators and site visitors. If an administrator views the manipulated content, the attacker may take over the admin account, and the CVSS score is 8.8 according to NVD.
Affected
- Prenotazioni WordPress plugin up to and including 1.7.5
- All WordPress sites with this plugin installed
Fixed in
- Unknown. WPScan lists 'No known fix' and no vendor advisory or patched release was found.
Workaround
- Deactivate and remove the plugin if it is not needed; this is the only measure that reliably closes the flaw.
- If it must remain, restrict access to the WordPress admin area and the plugin settings, for example by IP restrictions or a WAF.
- Check stored plugin settings and admin accounts for unexpected script content and review admin activity logs.
- Keep WordPress core and all other plugins up to date and enforce strong user permissions.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV according to third-party trackers (not verified directly against the CISA catalogue).
- Public proof of concept: unclear; no PoC code was verified.
- EPSS about 0.1% at the time of research.
- VulDB rates the vulnerability 4.3 (Medium) and states no exploit is available.
Our recommendation
- Run a plugin inventory on all WordPress sites to find Prenotazioni installations.
- Remove the plugin, or at least restrict access to its admin functions, until a vendor fix is confirmed.
- Monitor vendor and WPScan announcements for a fix and re-check the status before closing this item, as the NVD entry is still deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-103305 app.opencve.io
- VulDB 416505 vuldb.com
- NVD via Vulners vulners.com
- GitHub tracker issue 1708 github.com
- HOL Guard CVE entry hol.org
- Positive Technologies PT-2026-110008 vulners.com
- CVE-2024-31102 analysis (ogma.in) ogma.in
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:44.
Original description (NVD)
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.