CVE-2026-59558

WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

We have discovered 12,125 live websites that are affected by CVE-2026-59558.

Run a Free Instant Scan



Affected Software

Product  WP Booking Calendar
Category Wordpress Plugins
Vulnerable Domains12,125 live websites (100% of WP Booking Calendar install base)
Vulnerable Versions
  • from 0 through 11.4.2
Vulnerable Versions Count125 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 27, 2026
  • Updated - Jul 27, 2026

Credits

  • daroo | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-59558
United States2,496 websites


Germany1,558 websites
France976 websites
GB690 websites
Netherlands688 websites
Italy634 websites
Spain472 websites
Denmark410 websites
Switzerland316 websites
Canada262 websites

Website Distribution by TLD

Number of websites using CVE-2026-59558
.com4,112 websites
.de1,046 websites
.nl604 websites
.fr501 websites
.org462 websites
.it438 websites
.co.uk435 websites
.ch278 websites
.se243 websites
.dk235 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-59558

Top websites that are affected by CVE-2026-59558. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.no Norway**,***
*************.org United States***,***
****.ru Russia***,***
***********.**.uk GB***,***
**************.ca Canada***,***
*************.de Germany***,***
***********.***.br Brazil***,***
*********.cz Czech Republic***,***
**********.pl Poland***,***
****.de United States***,***
See full domain list

FAQ

CVE-2026-59558 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WP Booking Calendar
A total of 12,125 websites have been identified as vulnerable to CVE-2026-59558, based on global website indexing conducted by WebTechSurvey.
The WP Booking Calendar is affected by the CVE-2026-59558 vulnerability.
WP Booking Calendar versions up to and including 11.4.2 are vulnerable to CVE-2026-59558.