CVE-2026-103305

Summary

The Prenotazioni WordPress plugin allows unauthenticated users to save settings without proper authorization or CSRF protection, leading to stored XSS vulnerabilities that can affect both administrators and visitors. This creates a high-risk vector for executing malicious scripts in the context of privileged users.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and only needs a user to visit a crafted page with the malicious payload, though it may require social engineering to get administrators to interact with the compromised site.

Blast radius

The impact could be significant as attackers can execute arbitrary JavaScript in the context of admin sessions, potentially leading to full account takeover, data exfiltration, or modification of critical site settings and content.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.7.6 or later which includes proper authorization checks and CSRF protection for settings saving functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.