CVE-2026-96573: Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

Q: Are default installations affected by this issue?

No. The vulnerable rendering path requires the 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; its default value of 0 does not reach the exploitable decode-and-truncate branch.

Q: What does an attacker need to exploit it?

An attacker does not need authentication or user interaction to submit the malicious content. Exploitation depends on the affected setting being configured to a positive integer and on a user later accessing a page containing the injected content.

Q: Which plugin versions should be considered vulnerable?

All Appointment Hour Booking versions through 1.5.97, including 1.5.97, are affected according to the provided information.

Q: What can be done if an update cannot be applied immediately?

Set 'list_readmore_numberofwords' in Other Parameters to 0, or avoid configuring it with any positive integer value. This prevents the described exploitable branch from being used through this sink.

Published Oct 1, 2026

Updated

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'listreadmorenumberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.

Affected Software

1 affected component

CodePeople Appointment Hour Booking<=1.5.97

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Set the Other Parameters setting list_readmore_numberofwords to 0; the default value bypasses the decode-and-truncate branch and is not exploitable through this sink.
Appointment Hour Booking – Booking Calendar list_readmore_numberofwords = 0

Event History

Oct 1, 2026

CVE Published

via MITRE·08:28 AM

Data Sourced

via MITRE·08:28 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Are default installations affected by this issue?

No. The vulnerable rendering path requires the 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; its default value of 0 does not reach the exploitable decode-and-truncate branch.

What does an attacker need to exploit it?

An attacker does not need authentication or user interaction to submit the malicious content. Exploitation depends on the affected setting being configured to a positive integer and on a user later accessing a page containing the injected content.

Which plugin versions should be considered vulnerable?

All Appointment Hour Booking versions through 1.5.97, including 1.5.97, are affected according to the provided information.

What can be done if an update cannot be applied immediately?

Set 'list_readmore_numberofwords' in Other Parameters to 0, or avoid configuring it with any positive integer value. This prevents the described exploitable branch from being used through this sink.

CVE-2026-96573: Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

Affected Software

Remediation

Event History

Frequently Asked Questions

Are default installations affected by this issue?

What does an attacker need to exploit it?

Which plugin versions should be considered vulnerable?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Are default installations affected by this issue?

What does an attacker need to exploit it?

Which plugin versions should be considered vulnerable?

What can be done if an update cannot be applied immediately?