EUVD-2026-43705
GHSA-996f-334j-67g7
Severity by source
AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N
PR:H confirmed by admin-only write access; AC:L because once payload is stored any visitor triggers it without further attacker complexity; C:L added since XSS enables content and credential exfiltration in the victim browser session.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disable_booking_message setting via a rich-text editor and later passed directly to the public booking_message view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.
AnalysisAI
Stored XSS in Easy!Appointments versions prior to 1.6.0 allows an authenticated administrator to inject arbitrary HTML or JavaScript into the 'booking disabled' message field via the booking settings rich-text editor. The unsanitized value is rendered directly to every unauthenticated visitor who opens the public booking page while booking is disabled, crossing a scope boundary from admin context to anonymous public users. No public exploit has been identified at time of analysis; CVSS rates this 2.6 (Low) driven by the administrator-level privilege requirement, though the persistent cross-scope impact on all public visitors is a meaningful secondary risk factor.
Technical ContextAI
Easy!Appointments is a self-hosted PHP/CodeIgniter appointment scheduling web application (CPE: cpe:2.3:a:alextselegidis:easyappointments:*:*:*:*:*:*:*:*). The flaw falls under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). The root cause is missing output encoding at both storage and render layers: the disable_booking_message field accepted through a rich-text editor in the Booking_settings controller was stored without HTML sanitization and then rendered in booking_message.php via a bare PHP echo (<?= vars('message_text') ?>), bypassing all encoding. Commit 629a041 confirms the fix: a pure_html() sanitizer was applied at save time inside Booking_settings.php for all fields in the $rich_text_settings whitelist, and a second pure_html() call was added at render time in the view template, implementing defense-in-depth output encoding.
RemediationAI
Upgrade to Easy!Appointments version 1.6.0, which resolves the issue by applying pure_html() sanitization both at save time within Booking_settings.php and at render time in the booking_message.php view, as confirmed by commit 629a0415f54f75556c17f4f5d9c77fda1fdbdeae (https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae). If an immediate upgrade is not feasible, a targeted compensating control is to keep booking enabled so the vulnerable booking_message view path is never reached - note this has operational impact for organizations that legitimately need to suspend booking. Alternatively, audit and clear the disable_booking_message field directly in the database to eliminate any pre-existing malicious content, and restrict administrative access to MFA-protected, individually-audited accounts to reduce the likelihood of unauthorized payload injection.
More in Easyappointments
View allAn issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php f
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated critical severi
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments p
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS 8.8), th
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbit
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium severity (CVSS
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Ra
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated low severity (CVSS 3.8), this
Broken object-level authorization in Easy!Appointments 1.5.2 lets any authenticated user query the customers search endp
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today