Jetappointment
Monthly
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.