Appointment Booking Calendar EUVD-2026-111577

Exploitation requires an authenticated WordPress account that has been assigned as owner ('conwer') of a calendar through the Appointment Booking Calendar plugin's calendar list screen; because that UI lists all registered users regardless of role, an administrator can grant this to an account as low as Subscriber, enabling subscriber-level exploitation. On a default installation where no such assignment exists, the vulnerability requires editor-level access and above. The payload is injected via the 'vs_text_submitbtn' parameter and is stored; it executes only when a user subsequently accesses the injected page. Key limiting factors: the attacker must already be authenticated, must be granted calendar-owner status by an administrator (non-default), and a victim must view the affected page for the stored script to fire.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reported by Wordfence and tracked as this_month priority rather than an emergency. The network vector and low attack complexity are real, but the privilege signal is nuanced: the CVSS vector encodes PR:L (subscriber-and-above), yet the description makes clear that low-privilege exploitation is only possible AFTER an administrator assigns the attacker's account as a calendar owner ('conwer') via the plugin's calendar list screen - on a default installation the practical bar is editor-level access and above, which is closer to PR:H in effect. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so there is no evidence of active or at-scale exploitation; the this_month decision label and absence of KEV/EPSS data are consistent with a credible-but-not-urgent authenticated web flaw. The scope-change (S:C) and C:L/I:L reflect that injected script runs in the context of other users (potentially administrators) viewing the page, which is the main driver of risk here. Net: a genuine issue worth patching on a normal cadence, not a high-CVSS-but-illusory finding, but also not a drop-everything emergency - the authenticated prerequisite and the admin-granted calendar-owner condition meaningfully constrain real-world exploitability.

An attacker holding at least a subscriber account that an administrator has designated as a calendar owner submits a crafted payload in the 'vs_text_submitbtn' parameter, which the plugin stores without adequate sanitization or output escaping. When any user - including an administrator - later views the affected page, the stored script executes in their browser, enabling session/cookie theft or actions in that user's context. No public exploit was identified in the provided data, though Wordfence threat-intel and the plugin source (cpabc_apps_go.inc.php / cpabc_scheduler.inc.php) are referenced.