CVE-2026-6286: Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies sanitizetextfield() to customer firstName and lastName fields (BookingApplicationService.php lines 302-308), this function only removes HTML tags and preserves special characters including double quotes. The vulnerability manifests in the administrative Calendar view where a FullCalendar eventContent callback interpolates customer names directly into JavaScript template literals (redesign/dist/index.js line 199) and renders them via innerHTML without proper HTML entity encoding. Because double quotes are preserved, an attacker can inject payloads like '" onmouseover="alert(document.cookie)"' to break out of the title attribute and inject malicious event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator accesses the Calendar page and hovers over the malicious appointment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking for Appointments and Events Calendar – Amelia plugin for WordPressto a version that resolves this vulnerability.Fixed in 2.2 - Configuration
Update the Calendar admin view rendering path (redesign/dist/index.js line 199) so customer names are HTML-entity encoded before being used in the FullCalendar eventContent callback and inserted via innerHTML.
Booking for Appointments and Events Calendar – Amelia plugin for WordPress customer name HTML encoding in Calendar admin eventContent rendering = Encode customer firstName/lastName to HTML entities before inserting into JavaScript/innerHTML (double quotes preserved by sanitize_text_field() allow breakout like " onmouseover="alert(document.cookie)"; ensure proper encoding when interpolated into eventContent callback rather than rendering raw into innerHTML). - Compensating control
Restrict access so unauthenticated users cannot submit booking data that reaches the Calendar view (mitigates the described nonce-verification bypass where AddBookingCommand skips nonce verification in Command.php line 186).
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
Any unauthenticated remote attacker can submit crafted booking data because the booking command skips nonce verification. Exploitation does not require a user to click a malicious link, but an administrator must later access the administrative Calendar view for the stored script to execute.
Which input is used to store the malicious payload?
The customer firstName and lastName fields in a booking submission are the affected inputs. Although they are passed through sanitize_text_field(), double quotes are retained and can be used to escape the Calendar view's title attribute context.
What versions are known to be affected?
Versions up to and including 2.2 are affected. The provided information does not identify a fixed version.
What is the impact after a successful exploit?
An attacker can cause arbitrary JavaScript to run in an administrator's browser when that administrator views the Calendar. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.