CVE-2026-91847
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions. This allows any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
Risk Assessment
Attackers can access and manipulate private conversations of other users, compromising confidentiality and integrity, and potentially enabling social engineering.
Recommendation
Update the Online Scheduling and Appointment Booking System plugin to version 28.2 or later. Additionally, add conversation ownership checks before read and write operations.
Other vulnerabilities in Online Scheduling and Appointment Booking System
See all- CVE-2026-86841Low risk· EPSS 4%
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators. This allows users granted a custom booking-management capability (which an administrator must explicitly assign) to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
- CVE-2026-86839Low risk· EPSS 2%
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member. This allows authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.
- CVE-2026-13395High
The Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.
Original NVD description (English source)
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS