JetAppointment CVE-2026-93875

Exploitation requires that the target site runs the JetAppointment plugin (version ≤2.5.2.1) with its public booking form exposed and the unauthenticated jet_engine_form_booking_submit endpoint reachable - the default operating mode for a live booking form, so no special non-default configuration is needed for the injection itself. The payload is submitted via the 'friendlyTime' parameter with no authentication (PR:N). The principal LIMITING factor is that the stored script does not execute until a privileged user (an administrator) opens the specific appointment's details popup inside the WordPress admin panel; absent that admin action the payload lies dormant, so realistic impact depends on admin interaction rather than firing automatically.

This is a genuine, elevated-priority vulnerability rather than CVSS inflation, though it falls short of a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) describes a network-reachable, low-complexity, unauthenticated stored XSS with a changed scope - the unauthenticated injection point (the jet_engine_form_booking_submit endpoint) is a strong real-world driver because any internet attacker can plant the payload without credentials. The elevated signal is the scope change (S:C): the attacker's input, submitted to the public booking form, executes in a different security context - the WordPress administrator's authenticated session when the appointment popup is opened in wp-admin - which is the classic path to admin-session takeover. However, several key signals are MISSING from the input and should not be fabricated: no EPSS probability is provided, there is no CISA KEV listing, and no public exploit (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' One modeling tension to flag explicitly: the supplied vector uses UI:N, but the description states the script only fires 'when the appointment details popup is opened in the WordPress admin panel' - that is admin-side user interaction, so the true execution step depends on an administrator action even though the injection itself needs none. Net: prioritize patching above routine because of the unauthenticated, remote, scope-changing injection, but realistic impact hinges on an admin later viewing a malicious appointment.

An unauthenticated attacker submits the public JetAppointment booking form with a malicious script payload in the 'friendlyTime' parameter via the jet_engine_form_booking_submit endpoint, which stores it unsanitized in the wp_jet_appointments_meta table. When a site administrator later opens that appointment's details popup in the WordPress admin dashboard, the stored script executes in the admin's authenticated browser session, enabling session/cookie theft, CSRF-token abuse, or creation of a rogue admin account. No public exploit code is referenced in the provided data.