WP Time Slots Booking Form CVE-2026-40791

Exploitation requires a WordPress site running the codepeople WP Time Slots Booking Form plugin at version 1.2.46 or earlier with the booking form exposed on a public page, and per the CVSS vector requires victim user interaction (UI:R) such as clicking an attacker-crafted link or visiting a page containing injected content. No authentication is required of the attacker (PR:N), the attack is delivered over the network (AV:N) at low complexity (AC:L), and impact is constrained by the victim's privileges in the WordPress origin - highest impact occurs when an administrator or editor is the one tricked into triggering the payload.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L scores 7.1 (High) primarily because of the scope change (S:C) - injected script runs against the WordPress origin including potentially logged-in administrator sessions - but exploitation requires user interaction (UI:R), which lowers practical risk versus a no-interaction RCE. There is no KEV listing, no public EPSS score provided in the input, and no public exploit identified at time of analysis, so this is a real but not emergency-priority issue: highest risk is to sites whose admins or editors view attacker-controlled booking content. No EPSS or POC data is available in the provided intelligence, so widespread automated exploitation cannot be confirmed or ruled out from this dataset alone.

An unauthenticated attacker crafts a URL or booking-form submission containing a malicious JavaScript payload targeting the vulnerable plugin parameter and lures a site administrator or visitor to click the link or view the affected page. When the victim's browser renders the response, the script executes in the WordPress site origin and can steal session cookies, perform actions as the logged-in user, or pivot to admin takeover; no public exploit identified at time of analysis.