CVE-2026-91847

MediumCVSS 4.8/10Last modified Sep 21, 2026

Description

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Sep 19, 2026
Last modified: Sep 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-918487.3A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php CVE-2026-918496.3A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=u CVE-2026-91857.5The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and includ CVE-2026-918515.3Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::CVE-2026-918526.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affect CVE-2026-918537.4A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-b CVE-2026-918544.3A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such CVE-2026-918555.3A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/CVE-2026-918575.3Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: CVE-2026-918586.5FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newI CVE-2026-918595.3Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController ex CVE-2026-91866.5IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoof