CVE-2026-93875

Name of the Vulnerable Software and Affected Versions JetAppointment versions prior to 2.5.2.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the friendlyTime parameter at the jet engine form booking submit endpoint. The injected payload is stored in the wp jet appointments meta table and executes in the administrator's browser when the appointment details popup is opened within the WordPress admin panel.

Recommendations Update to a version newer than 2.5.2.1. Avoid using the friendlyTime parameter in the jet engine form booking submit endpoint until the update is applied.