Executive brief
The Appointment Booking Calendar plugin for WordPress, used to manage customer appointments, contains a security flaw that allows users with Author-level access or higher to inject malicious scripts into the website. These scripts can run automatically whenever other users or administrators visit the affected pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.
Technical details
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on custom booking field labels. An authenticated attacker with Author-level permissions or higher can inject arbitrary web scripts into these fields. Because the input is stored in the database and later rendered without proper security filtering, the scripts will execute in the browser of any user who accesses the affected page. This vulnerability is tracked as CWE-79 and affects all versions up to and including 1.4.4.
Affected products
- Creavi Creavi Appointment Booking Calendar up to, and including, 1.4.4
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
References
- https://plugins.trac.wordpress.org/browser/creavi-booking-service/tags/1.1.0/assets/js/booking.js
- https://plugins.trac.wordpress.org/browser/creavi-booking-service/trunk/assets/js/booking.js
- https://plugins.trac.wordpress.org/changeset/3564451/creavi-booking-service
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2618ccde-2bb0-4cd4-b415-68a671507709?source=cve