Appointment Hour Booking CVE-2026-65514

Exploitation requires an authenticated WordPress session with at minimum the Contributor role - this is a non-default condition on sites with closed registration, but common on sites that allow open registration or have multiple content authors. The attacker must be able to submit or create a booking entry through the plugin's interface. Victim interaction is required: a higher-privileged user (editor or administrator) must view or process the malicious booking entry in their browser session. Limiting factors include: (1) the need for a contributor-level WordPress account, which is gated by site registration policy; (2) the requirement for a privileged user to actively view the poisoned content; (3) sites with only administrator users and no contributors are not exploitable via this path.

The NVD CVSS score of 6.5 (Medium) is appropriate given the exploitation prerequisites. The PR:L metric confirms exploitation requires at minimum a Contributor-level WordPress account, which significantly limits opportunistic attack surface compared to unauthenticated XSS. The UI:R metric further reduces real-world risk by requiring a privileged user to interact with attacker-controlled content before the payload fires. However, the S:C (scope change) metric elevates this beyond a self-XSS: a successful payload executing in an administrator's browser can lead to session hijacking, unauthorized plugin/settings changes, or web shell installation via WordPress admin actions - making the effective blast radius higher than C:L/I:L/A:L suggests at the base CVSS level. No EPSS data was provided in the intelligence package, so exploitation probability cannot be quantified. The absence of KEV listing and public POC indicates this has not been weaponized at scale, but the low attack complexity once contributor access is obtained keeps it a real lateral-escalation concern on multi-author WordPress sites.

An attacker who has obtained or registered a Contributor account on a target WordPress site injects a malicious JavaScript payload (e.g., a cookie-stealing script or admin action trigger) into an appointment booking field that is stored and later rendered in the WordPress admin dashboard. When an administrator reviews or manages the booking, the script executes in their browser session, potentially exfiltrating the admin's session cookie or silently creating a new administrator account for persistent access.