CVE-2026-96573 in Appointment Hour Booking Plugin
Summary
by MITRE • 10/01/2026
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The Appointment Hour Booking plugin for WordPress, specifically within versions up to and including 1.5.97, contains a critical security flaw classified as Stored DOM-Based Cross-Site Scripting. This vulnerability arises from insufficient input sanitization and output escaping mechanisms embedded within the Schedule Calendar List Renderer component of the application. The core technical issue lies in how the plugin processes data submitted through Booking Form Single-Line Fields. When an attacker submits malicious script content via these fields, the system fails to adequately neutralize special characters or encode the input before it is stored in the database and subsequently rendered back into the browser environment. This lack of proper encoding allows raw JavaScript code to persist within the application's state rather than being treated as inert text data.
The operational impact of this vulnerability is severe because it enables unauthenticated attackers to inject arbitrary web scripts that execute automatically whenever a legitimate user accesses pages containing the injected content. Unlike reflected XSS, where exploitation requires tricking a user into clicking a specially crafted link, stored DOM-based XSS persists on the server side or in client-side storage until rendered. This means that any visitor viewing the affected calendar list will have their session compromised without needing to interact with a specific malicious payload directly. The attack vector is particularly dangerous because it targets unauthenticated users, meaning no prior login credentials are required to initiate the exploitation chain. Once executed, the injected scripts can perform actions such as stealing session cookies, hijacking user sessions, defacing websites, or redirecting victims to phishing sites designed to harvest sensitive information.
A critical technical nuance in exploiting this vulnerability involves a specific configuration parameter known as list_readmore_numberofwords. The exploitability of this flaw is contingent upon this setting being configured with a positive integer value. This parameter dictates how much text is displayed before truncation occurs during the rendering process. When set to zero, which is the default configuration for many installations, the application bypasses the specific code branch responsible for decoding and truncating content. Consequently, under default settings, the vulnerable sink is not triggered because the problematic rendering logic is skipped entirely. This creates a scenario where administrators who have not customized this advanced setting are technically protected from exploitation via this specific vector, although they remain at risk if they modify the configuration to display more than zero words in the read-more context.
From an industry standards perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored nature of the attack also correlates with MITRE ATT&CK technique T1059, specifically sub-techniques related to JavaScript execution in web browsers. To mitigate this risk, administrators should immediately update the Appointment Hour Booking plugin to a version newer than 1.5.97 where these sanitization and escaping issues have been resolved by the developers. For those unable to upgrade instantly due to compatibility constraints or other operational reasons, it is imperative to verify that the list_readmore_numberofwords setting remains at its default value of zero if possible, although this should be viewed as a temporary workaround rather than a robust security control. Implementing a Web Application Firewall can also provide an additional layer of defense by filtering out malicious script injections before they reach the application logic or database storage layers.