CVE-2026-65514
MediumCVSS 6.5Summary
The Appointment Hour Booking plugin versions up to 1.5.86 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
Risk Assessment
The risk includes session theft, redirection to malicious sites, or theft of data from visitors of the affected page.
Recommendation
Update the Appointment Hour Booking plugin to the latest version and restrict contributor permissions.
Other vulnerabilities in Appointment Hour Booking
See all- CVE-2026-66679Medium
Broken Access Control vulnerability in Appointment Hour Booking versions up to 1.5.91. The attack does not require authentication.
- CVE-2026-16282Medium
The Appointment Hour Booking WordPress plugin before version 1.5.88 does not validate a client-supplied booking price against the server-side configured service price. Unauthenticated users can submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.