Executive brief
Easy Appointments is a WordPress plugin for booking and appointment management. A DOM-based cross-site scripting vulnerability allows attackers to inject malicious scripts into web pages viewed by site visitors, potentially stealing customer data, hijacking accounts, or compromising the booking system's integrity.
Technical details
The vulnerability is a DOM-based cross-site scripting (XSS) flaw stemming from improper neutralization of user-supplied input during web page generation. The vulnerable component fails to properly sanitize or escape user inputs before rendering them in the DOM, allowing attackers to inject arbitrary JavaScript. The attack requires user interaction (such as clicking a malicious link or visiting a crafted page) but does not require authentication. Successful exploitation enables attackers to execute arbitrary code in the context of victims' browsers, leading to credential theft, session hijacking, or malware injection. As of the advisory date, no official patch was available; Patchstack has issued a mitigation rule as a temporary defense.
Affected products
- Easy Appointments Easy Appointments through 4.0.2.2
Timeline
- 2026-09-08: disclosed: Vulnerability published on NVD
- 2026-09-07: advisory: Patchstack advisory issued
- 2026-03-18: other: Vulnerability reported to Patchstack by 0xzenko