Executive brief
The Appointment Hour Booking plugin for WordPress, which is used to manage schedules and appointments, contains a security vulnerability that allows users with contributor-level access to inject malicious scripts into the website. If an administrator or another site visitor views the affected content, these scripts could execute, potentially leading to unauthorized actions, website defacement, or the theft of sensitive session information. This issue can be resolved by updating the plugin to the latest version.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Appointment Hour Booking plugin for WordPress (versions <= 1.5.86) due to improper neutralization of input during web page generation (CWE-79). An attacker with 'Contributor' or higher privileges can inject malicious JavaScript payloads into the application. The vulnerability requires a privileged user (such as an administrator) to interact with the affected page for the script to execute in their browser context. This could lead to session hijacking or unauthorized administrative actions. The issue is addressed in version 1.5.87.
Affected products
- codepeople Appointment Hour Booking <= 1.5.86
Timeline
- 2026-07-09: disclosed: Reported by Ananda Dhakal via Patchstack
- 2026-07-23: advisory: NVD and Patchstack published advisory details
- 2026-07-23: patched: Version 1.5.87 released to address the vulnerability