XSS in Appointment Booking Plugin
CVE-2026-105258
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (6.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Appointment Booking Plugin
Weakness classification (CWE)
References
- wpscan.com/vulnerability/134c2bda-aa25-4c79-b2b0-171b17e18591/ (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-105258?
- CVE-2026-105258 is a low-severity vulnerability in Appointment Booking Plugin, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2026-10-29.
- How severe is CVE-2026-105258?
- Low severity. CVSS v3 base score is 3.5 out of 10.