EUVD-2026-48119
GHSA-25g3-wph6-6rwc
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
PR:L confirmed by contributor-role requirement; UI:R for admin interaction; S:C for cross-session script execution; A:N as XSS does not cause direct availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
AnalysisAI
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated contributors to inject and persist malicious JavaScript payloads that execute in the browsers of higher-privileged users, such as site administrators, who view the affected content. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier stored XSS with scope change, meaning the impact propagates beyond the attacker's own session into the administrative context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum the Contributor role - this is a non-default condition on sites with closed registration, but common on sites that allow open registration or have multiple content authors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 6.5 (Medium) is appropriate given the exploitation prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or registered a Contributor account on a target WordPress site injects a malicious JavaScript payload (e.g., a cookie-stealing script or admin action trigger) into an appointment booking field that is stored and later rendered in the WordPress admin dashboard. When an administrator reviews or manages the booking, the script executes in their browser session, potentially exfiltrating the admin's session cookie or silently creating a new administrator account for persistent access. |
| Remediation | The primary remediation is to update the Appointment Hour Booking plugin beyond version 1.5.86; however, no specific patched release version was confirmed in the available intelligence - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/appointment-hour-booking/vulnerability/wordpress-appointment-hour-booking-plugin-1-5-86-cross-site-scripting-xss-vulnerability and the WordPress plugin repository for the latest available version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Appointment Hour Booking
View allThe Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. Ra
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new cal
Price manipulation in the Appointment Hour Booking WordPress plugin (all versions before 1.5.88) allows any unauthentica
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. Rated high severity (CVSS
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fiel
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field par
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.7
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today