CVE-2026-105258

LowCVSS 3.5/10Last modified Oct 29, 2026

Description

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Appointment Booking Plugin	< 5.7.6

References

https://wpscan.com/vulnerability/134c2bda-aa25-4c79-b2b0-171b17e18591/

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1052596.8The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploade CVE-2026-105265.8The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticate CVE-2026-1052604.3The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted a CVE-2026-1052616.8The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.CVE-2026-1052628.0The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a CVE-2026-1052634.7A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application CVE-2026-1052655.3A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to ca CVE-2026-1052678.1The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handl CVE-2026-1052684.3The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments CVE-2026-1052696.8Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operato CVE-2026-105276.3Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role CVE-2026-1052708.7Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to e