CVE-2026-105258
Low
Description
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
SeverityLow
CVSS3.5
Exploit probability—
ProductAppointment Booking Plugin
PublishedOct 29, 2026
First seenNov 4, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Appointment Booking Plugin5.7.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Appointment Booking Plugin | v < 5.7.6 | 5.7.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.