Stored Cross-Site Scripting Vulnerability in Appointment Booking Calendar for WordPress

CVE-2026-111727

What is CVE-2026-111727?

The Appointment Booking Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping via the 'vs_text_submitbtn' parameter. This vulnerability affects all versions up to and including 1.4.05. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious web scripts, which will execute on pages viewed by others. An attacker must be assigned as a calendar owner by an administrator, who can grant this role even to lower-level users, further increasing the attack surface. Exploiting this vulnerability allows unauthorized script execution whenever an injected page is accessed.

References