Executive brief
The Booking for Appointments and Events Calendar plugin for WordPress is used to manage appointment scheduling and event calendars on websites. Attackers with Contributor-level or higher access who can use Elementor can inject malicious scripts into pages; these scripts execute whenever a visitor views the affected page, potentially stealing session data, redirecting users, or defacing site content.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability in multiple Elementor widget classes within the plugin. The root cause is insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods. An authenticated attacker with Contributor-level access and above who can use Elementor can inject arbitrary JavaScript into pages. The injected script is stored and executes in the browser of any user who visits the affected page. The vulnerability was partially patched in version 2.4.8, but remained in versions up to 2.4.9. A complete fix should be applied to all affected Elementor widget render methods.
Affected products
- WordPress Booking for Appointments and Events Calendar up to and including 2.4.9
Timeline
- 2026-09-12: disclosed
- 2026-09-12: patched: Version 2.4.8 provided a partial patch; complete fix status unclear