{"id":"CVE-2026-105258","published":"2026-10-29T06:17:17.317","lastModified":"2026-10-29T06:17:17.317","description":"The Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/134c2bda-aa25-4c79-b2b0-171b17e18591/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}