CVE-2026-96573

Name of the Vulnerable Software and Affected Versions Appointment Hour Booking – Booking Calendar plugin for WordPress versions prior to 1.5.98

Description Insufficient input sanitization and output escaping in the Schedule Calendar List Renderer allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the Booking Form Single-Line Field, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. This issue is exploitable only if the list readmore numberofwords parameter is configured with a positive integer value, as the default value of 0 bypasses the vulnerable code path.

Recommendations Update the plugin to a version newer than 1.5.97. Set the list readmore numberofwords parameter to 0 to mitigate the risk of exploitation.