CVE-2026-1083 is a stored cross-site scripting vulnerability in the Appointment Hour Booking – Booking Calendar WordPress plugin (versions up to 1.5.60). It results from improper neutralization of input in the 'Min length/characters' and 'Max length/characters' form field configuration parameters. Authenticated administrators can inject malicious scripts that execute in the context of users accessing the form builder interface. This vulnerability affects multi-site WordPress installations and installations where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges.

An authenticated attacker with administrator-level privileges can inject stored malicious scripts via specific form field configuration parameters. These scripts execute when users access the form builder interface, potentially leading to limited confidentiality and integrity impacts within the affected environment. The vulnerability does not affect availability and requires high privileges and high attack complexity, limiting its exploitation scope.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or limiting use of the vulnerable form field configuration parameters in multi-site environments or where unfiltered_html is disabled.