What is the CVSS score of CVE-2026-40791?

CVE-2026-40791 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Time Slots Booking Form are affected by CVE-2026-40791?

The WP Time Slots Booking Form WordPress plugin (versions ≤1.2.46) contains an unauthenticated cross-site scripting vulnerability (CVE-2026-40791, CVSS 7.1) allowing remote attackers to inject…

How to fix or mitigate CVE-2026-40791?

Within 24 hours: inventory all WordPress deployments running WP Time Slots Booking Form and identify affected versions (≤1.2.46). Within 7 days: disable or remove the plugin from production environments; if operationally required, deploy Web Application Firewall rules to block XSS payloads targeting plugin input fields. Within 30 days: monitor vendor advisory for patched version release; evaluate and plan migration to alternative booking plugins with active security maintenance; execute migration upon patch availability and vendor testing confirmation.

WP Time Slots Booking Form CVE-2026-40791

EUVD-2026-36994 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-hp53-p4r8-2m96

XSS Wp Time Slots Booking Form

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable WordPress plugin, no attacker auth (PR:N), requires victim click (UI:R); scope changes to WordPress origin (S:C) with limited C/I/A in the victim's session.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:05 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.

AnalysisAI

Reflected/stored cross-site scripting in the WP Time Slots Booking Form WordPress plugin (versions up to and including 1.2.46) lets remote unauthenticated attackers inject script that executes in a victim's browser after user interaction. The flaw, reported by Patchstack and tracked as EUVD-2026-36994, carries a CVSS 7.1 due to the scope change against the WordPress origin, and no public exploit identified at time of analysis.

Technical ContextAI

The vulnerable component is the codepeople 'WP Time Slots Booking Form' plugin for WordPress (CPE cpe:2.3:a:codepeople:wp_time_slots_booking_form), which provides time-slot reservation forms on WordPress sites. The weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input handled by the plugin's booking or form-rendering logic is reflected or stored without proper output encoding or input sanitization, allowing HTML/JavaScript injection in the context of the WordPress site origin.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should upgrade WP Time Slots Booking Form to the latest version newer than 1.2.46 as published by codepeople and tracked at https://patchstack.com/database/wordpress/plugin/wp-time-slots-booking-form/vulnerability/wordpress-wp-time-slots-booking-form-plugin-1-2-46-cross-site-scripting-xss-vulnerability. As compensating controls until the plugin is updated, deactivate the WP Time Slots Booking Form plugin on production sites (side effect: booking functionality is unavailable), restrict access to pages embedding the booking form via authentication or IP allowlist where feasible, and enable a WAF rule or Patchstack mitigation that blocks script tags and common XSS payloads in plugin request parameters (side effect: may produce false positives against legitimate form content containing HTML).