{"id":"CVE-2026-105258","kind":"vulnerability","aliases":["CVE-2026-105258"],"related":[],"title":"WordPress Appointment Booking plugin: booking form lets admins inject scripts into visitors' browsers","description":"The Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.","summary":"The Appointment Booking Plugin for WordPress does not escape several booking-form step settings before showing them on the public form. An administrator can inject JavaScript that runs in the browser of any visitor who loads the booking form, and on multisite this reaches visitors who have no account.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-5.7.6-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get appointment-booking --field=version` if WP-CLI is available (plugin slug unknown; confirm in the sources).\n- Look for the plugin's booking-form step content settings and check whether any stored values contain script tags.","fix":"- Update the Appointment Booking Plugin to `5.7.6` or later.","status":"open","published_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:12+00:00","triaged_at":"2026-10-29T06:54:59+00:00","updated_at":"2026-10-29T06:54:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T06:54:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Appointment Booking Plugin to `5.7.6` or later.","reach":"internet","title":"WordPress Appointment Booking plugin: booking form lets admins inject scripts into visitors' browsers","impact":"medium","summary":"The Appointment Booking Plugin for WordPress does not escape several booking-form step settings before showing them on the public form. An administrator can inject JavaScript that runs in the browser of any visitor who loads the booking form, and on multisite this reaches visitors who have no account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","multisite"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"visitors' browsers run attacker-supplied scripts on the booking form","analyst_note":"Confirm the plugin slug and the exact fixed version from the vendor or NVD entry; sources give only 'before 5.7.6'.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get appointment-booking --field=version` if WP-CLI is available (plugin slug unknown; confirm in the sources).\n- Look for the plugin's booking-form step content settings and check whether any stored values contain script tags.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-5.7.6-or-later"],"who_is_affected":"Sites running the Appointment Booking Plugin for WordPress before 5.7.6, especially multisite installs where administrators lack the unfiltered_html capability. Exposure depends on who can edit booking-form step content; sites where only fully trusted administrators edit it carry lower risk. Sites not running this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4158,"output_tokens":649,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105258':16A,19A '-2026':15A,18A '5.7.6':83C 'account':75B 'admin':8A 'administr':49B,109C,128C 'allow':102C 'appoint':2A,27B,77C 'book':3A,5A,28B,37B,64B,78C,89C,100C 'booking-form':36B,88C 'boundari':140C 'browser':13A,57B,117C 'capabl':135C 'content':92C 'cross':137C 'cve':14A,17A 'escap':34B,86C 'execut':114C 'form':6A,38B,47B,65B,90C,101C,124C 'high':104C 'high-privileg':103C 'hold':131C 'html':134C 'inject':9A,51B,111C 'javascript':52B,112C 'let':7A 'load':62B,122C 'multisit':20B,68B,126C 'packag':21B 'plugin':4A,25B,29B,79C,81C 'privileg':105C,139C 'public':46B,99C 'reach':70B 'render':95C 'run':54B 'script':10A 'set':40B,93C 'sever':35B,87C 'show':42B 'step':39B,91C 'unauthent':142C 'unfilt':133C 'user':106C 'visitor':12A,60B,71B,120C,143C 'wordpress':1A,22B,24B,31B,80C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Appointment Booking Plugin for WordPress before 5.7.6, especially multisite installs where administrators lack the unfiltered_html capability. Exposure depends on who can edit booking-form step content; sites where only fully trusted administrators edit it carry lower risk. Sites not running this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105258","severity":null,"published_at":"2026-10-29T06:17:17+00:00","modified_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:12+00:00","fetched_at":"2026-10-29T06:53:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}