CVE-2026-10148 in Booking for Appointments and Events Calendar Plugin
Summary
by MITRE • 09/12/2026
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The Booking for Appointments and Events Calendar plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting, affecting versions up to and including 2.4.9. This vulnerability stems from insufficient input sanitization and output escaping mechanisms within the render methods of several Elementor widgets integrated into the plugin architecture. Specifically, the load_manually parameter is processed without adequate validation or encoding before being rendered in the browser context. Because this data persists on the server side as part of the appointment or event configuration, any malicious script injected through this vector remains active until manually removed by an administrator, creating a persistent threat surface that extends beyond simple session-based attacks.
The operational impact of this vulnerability is significant due to its stored nature and the specific privilege level required for exploitation. Attackers with Contributor-level access or higher who possess the ability to use Elementor can inject arbitrary web scripts into pages managed through the plugin. When other users, including administrators or regular visitors, view these compromised pages, the malicious JavaScript executes within their browser session. This execution context allows attackers to perform a wide range of hostile actions, such as stealing administrative cookies and session tokens, defacing websites, redirecting users to phishing sites, or installing keyloggers to capture sensitive credentials entered on other parts of the site. The persistence of this data means that even if the initial attacker is removed from the system, the malicious code continues to affect subsequent visitors until the vulnerability is patched and affected records are cleaned.
From a technical classification perspective, this flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves server-side storage of untrusted data that is later rendered without proper encoding, distinguishing it from reflected XSS where the payload is only present in a single request response. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK ID T1059, specifically Command and Scripting Interpretation via JavaScript within web applications. The partial patch introduced in version 2.4.8 likely addressed some instances but failed to fully remediate all affected render methods or parameters, leaving the broader attack vector open until the complete fix was released in subsequent versions.
To mitigate this risk, organizations using the Booking for Appointments and Events Calendar plugin must immediately upgrade to a patched version that exceeds 2.4.9 where these sanitization issues are resolved. Input validation should be strictly enforced on all user-supplied data before it is stored in the database, ensuring that only expected character sets are accepted. Furthermore, output encoding must be applied consistently whenever this data is rendered into HTML contexts to prevent browser interpretation of injected scripts. Security teams should also audit existing appointments and events for any signs of malicious script injection, particularly if Contributor-level access was granted without strict oversight. Implementing a Web Application Firewall with rules targeting XSS patterns can provide an additional layer of defense by blocking exploit attempts before they reach the application logic.