CVE-2026-40791

11th percentile - higher than 11% of all known CVEs

Versions of WP Time Slots Booking Form up to 1.2.46 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the security of the application and the organization's data.

It is recommended to update the WP Time Slots Booking Form plugin to the latest version to mitigate this vulnerability.