Cross-Site Scripting Vulnerability in Appointment Booking Plugin for WordPress
CVE-2026-105258
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 October 2026
Badges
What is CVE-2026-105258?
The Appointment Booking Plugin for WordPress, specifically versions prior to 5.7.6, is susceptible to a cross-site scripting vulnerability due to insufficient escaping of booking-form step content settings. This flaw enables high-privilege users, like administrators, to inject potentially malicious JavaScript into the booking form. When visitors load the form, this injected script executes in their browsers. In a multisite context, even if administrators lack the unfiltered_html capability, this vulnerability can allow unauthorized access to unauthenticated visitors, effectively breaking the expected privilege boundaries.
Affected Version(s)
Appointment Booking Plugin 0 < 5.7.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.