CVE-2026-10148
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. An authenticated attacker with Contributor-level access and above who can use Elementor can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.
Risk Assessment
Injected scripts can execute in visitors' browsers, leading to session theft, redirects, or other actions in the victim's context.
Recommendation
Update the plugin to a version later than 2.4.9 (partially patched in 2.4.8), or restrict Elementor usage for low-privilege users.
Other vulnerabilities in Booking for Appointments and Events Calendar
See all- CVE-2026-14215Medium
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
- CVE-2026-77704Low
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
- CVE-2026-14216Medium
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
- CVE-2026-14212Medium
The Booking for Appointments and Events Calendar WordPress plugin before version 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated. This allows any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
- CVE-2026-14213Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
- CVE-2026-14214Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.
Original NVD description (English source)
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS