CVE-2026-52838
LowCVSS 2.6Summary
A stored XSS vulnerability in Easy!Appointments allows an administrator to inject malicious HTML/JavaScript into the booking disabled message field. This content is displayed unsanitized on the public booking page, affecting every unauthenticated visitor.
Risk Assessment
The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of customer personal data.
Recommendation
Upgrade Easy!Appointments to version 1.6.0 or later immediately, which fixes the vulnerability.
Original NVD description (English source)
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.