CVE-2026-111727: Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vstextsubmitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a per-user grant that any administrator can extend to users as low as Subscriber level through the plugin's calendar list screen. Exploitation by attackers with subscriber-level access and above requires that an administrator has assigned the attacker's account as owner (conwer) of a calendar via the plugin's calendar list screen; the plugin's UI lists all registered users regardless of role, so a Subscriber can be assigned. On a default installation, where that is not configured, the vulnerability requires attackers with editor-level access and above.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this in a default installation?
On a default installation, exploitation requires an attacker with editor-level access or higher. A Subscriber can exploit it only after an administrator assigns that account as the owner of a calendar through the plugin's calendar list screen.
What additional access or configuration does a Subscriber need?
The Subscriber must be granted calendar-owner status through the conwer assignment in the plugin's calendar list screen. The interface lists all registered users regardless of role, so administrators can assign this privilege to Subscriber accounts.
What is the impact if the issue is exploited?
An attacker can inject arbitrary script into a page, and that script executes when another user accesses the injected page. The reported impact includes confidentiality and integrity effects, with no availability impact stated.
Which installations are affected?
All Appointment Booking Calendar versions up to and including 1.4.05 are affected.