CVE-2026-105258
CVE-2026-105258 · LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
CVSS 3.5 · Baja · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
appointment booking plugin
- Versiones
- ≥ 0, < 5.7.6: Afectada (semver)
Actualiza a 5.7.6