CVE-2026-96573: Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'listreadmorenumberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the Other Parameters setting list_readmore_numberofwords to 0; the default value bypasses the decode-and-truncate branch and is not exploitable through this sink.
Appointment Hour Booking – Booking Calendar list_readmore_numberofwords = 0
Event History
Frequently Asked Questions
Are default installations affected by this issue?
No. The vulnerable rendering path requires the 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; its default value of 0 does not reach the exploitable decode-and-truncate branch.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction to submit the malicious content. Exploitation depends on the affected setting being configured to a positive integer and on a user later accessing a page containing the injected content.
Which plugin versions should be considered vulnerable?
All Appointment Hour Booking versions through 1.5.97, including 1.5.97, are affected according to the provided information.
What can be done if an update cannot be applied immediately?
Set 'list_readmore_numberofwords' in Other Parameters to 0, or avoid configuring it with any positive integer value. This prevents the described exploitable branch from being used through this sink.