CVE-2026-1856 describes a stored cross-site scripting vulnerability in the Creavi Appointment Booking Calendar plugin for WordPress, affecting all versions up to and including 1.4.4. The flaw allows authenticated attackers with Author-level privileges or above to inject arbitrary web scripts through custom booking field labels due to improper neutralization of input during web page generation. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the Author level.

An attacker with Author-level access can inject persistent malicious scripts into booking field labels, which execute in the browsers of users who access the affected pages. This can lead to information disclosure or manipulation of user sessions. The vulnerability does not directly impact availability but compromises confidentiality and integrity to a limited extent.

No official patch or remediation is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or limiting use of custom booking field labels to reduce exposure.