CVE-2026-0742 is a stored cross-site scripting vulnerability in the Smart Appointment & Booking plugin for WordPress, affecting all versions up to and including 1.0.7. The issue stems from inadequate sanitization and escaping of user-supplied input in the saab_save_form_data AJAX action. Authenticated attackers with Subscriber-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity.

An attacker with at least Subscriber-level access can inject persistent malicious scripts into pages via the vulnerable AJAX action. These scripts execute in the browsers of users who view the compromised pages, potentially leading to theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch information is currently available. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider restricting Subscriber-level access and reviewing user input handling where possible to reduce risk.