Stored Cross-Site Scripting Vulnerability in Appointment Hour Booking Plugin for WordPress

CVE-2026-1083

What is CVE-2026-1083?

The Appointment Hour Booking plugin for WordPress is susceptible to stored cross-site scripting due to inadequate sanitization of user input in the 'Min length/characters' and 'Max length/characters' fields. Attackers with administrator privileges can exploit this vulnerability in multi-site WordPress installations, particularly where the unfiltered_html option is disabled. This allows them to inject arbitrary web scripts that run when a user accesses the form builder interface, potentially compromising the site's security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References