iGMS Direct Booking
iGMS Direct Booking has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for iGMS Direct Booking has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. iGMS Direct Booking is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2026-88825iGMS Direct Booking <= 1.0 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records
iGMS Direct Booking
Author
igms
iGMS Direct Booking Widget allows your guests to make direct reservations with you right via your website. Direct Booking Widget is developed by iGMS (www.igms.com). By using the plugin you agree to the iGMS terms of use (https://www.igms.com/terms/). All reservations created and accepted through the Direct Booking Widget are stored, managed, and processed by iGMS in accordance with the privacy policy (https://www.igms.com/privacy-policy/). iGMS is committed to secure your data.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C