---
id: "CVE-2026-105258"
kind: "vulnerability"
aliases: ["CVE-2026-105258"]
title: "WordPress Appointment Booking plugin: booking form lets admins inject scripts into visitors' browsers"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multisite", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "version-5.7.6-or-later"]
published_at: "2026-10-29T06:17:17+00:00"
first_seen_at: "2026-10-29T06:53:12+00:00"
updated_at: "2026-10-29T06:54:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105258", "first_seen_at": "2026-10-29T06:53:12+00:00"}]
---

# WordPress Appointment Booking plugin: booking form lets admins inject scripts into visitors' browsers

The Appointment Booking Plugin for WordPress does not escape several booking-form step settings before showing them on the public form. An administrator can inject JavaScript that runs in the browser of any visitor who loads the booking form, and on multisite this reaches visitors who have no account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get appointment-booking --field=version` if WP-CLI is available (plugin slug unknown; confirm in the sources).
- Look for the plugin's booking-form step content settings and check whether any stored values contain script tags.

## Fix

- Update the Appointment Booking Plugin to `5.7.6` or later.

## Timeline

- 2026-10-29T06:53:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105258

## From the sources

The Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_