Unknown WP Booking System

• CVE-2026-109147 High 7.1 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter 0.2%
• CVE-2026-107126 High 8.8 WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header 0.5%