CVE-2026-10148

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.5.0

Description Stored Cross-Site Scripting occurs via multiple Elementor widgets due to insufficient input sanitization and output escaping on the load manually parameter within the render() methods of classes. Authenticated attackers with Contributor-level access or higher who can use Elementor can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version later than 2.4.9.