Appointment Hour Booking EUVD-2026-90566

Exploitation requires the plugin's 'list_readmore_numberofwords' Other Parameters setting to be set to a positive integer; the default value of 0 bypasses the decode-and-truncate branch in the Schedule Calendar List Renderer and is NOT exploitable through this sink. Given that gate, an unauthenticated attacker can inject via a Booking Form single-line field, but the stored script only fires when a user subsequently loads the affected schedule/booking list page (victim page access is the trigger). Limiting factors: non-default configuration required, dependency on a victim viewing the rendered page, and only Low confidentiality/integrity impact (browser-context script execution, not server compromise).

Signals point to a moderate, conditional web risk rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2) describes a network-reachable, unauthenticated stored XSS with scope change but only Low confidentiality and integrity impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided - exploitation status is 'no public exploit identified at time of analysis.' The most important mitigating signal is NOT in the raw CVSS vector: the description explicitly states exploitation is only possible when the 'list_readmore_numberofwords' Other Parameters setting is set to a positive integer, and the shipped default of 0 bypasses the vulnerable decode-and-truncate branch entirely. This is a non-default configuration gate that the CVSS AC:L metric does not reflect, so the real-world reachability is narrower than 7.2 suggests. Net: a credible stored XSS worth patching on affected sites that have customized this setting, but not a mass-exploitation emergency.

An unauthenticated attacker submits a booking through the plugin's form, placing a malicious script payload into a single-line field. On a site where 'list_readmore_numberofwords' is configured to a positive integer, the Schedule Calendar List Renderer decodes and truncates that field and injects it into the DOM without proper escaping, so the script executes in the browser of any user (e.g. an admin or staffer) who later views the schedule/booking list page. No public proof-of-concept was provided in the input.