Live › vulnerability › CVE-2026-105258
The Appointment Booking Plugin for WordPress does not escape several booking-form step settings before showing them on the public form. An administrator can inject JavaScript that runs in the browser of any visitor who loads the booking form, and on multisite this reaches visitors who have no account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Appointment Booking Plugin for WordPress before 5.7.6, especially multisite installs where administrators lack the unfiltered_html capability. Exposure depends on who can edit booking-form step content; sites where only fully trusted administrators edit it carry lower risk. Sites not running this plugin can skip it.
No product ranges from the sources yet.
wp plugin get appointment-booking --field=version if WP-CLI is available (plugin slug unknown; confirm in the sources).5.7.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
This page as .md · .json · in your agent: get_signal("CVE-2026-105258")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.