CVE-2026-6286: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in melograno Booking for Appointments and Events Calendar – Amelia

CVE-2026-6286 describes a stored cross-site scripting vulnerability in the Booking for Appointments and Events Calendar – Amelia WordPress plugin, affecting versions up to and including 2.2. The vulnerability is due to an authentication bypass in the AddBookingCommand that skips nonce verification, allowing unauthenticated submission of booking data. Although the plugin applies sanitize_text_field() to customer firstName and lastName fields, this function only removes HTML tags but leaves special characters such as double quotes intact. These fields are then interpolated directly into JavaScript template literals in the administrative Calendar view and rendered using innerHTML without proper HTML entity encoding. This improper neutralization allows injection of malicious event handlers, enabling arbitrary script execution when an administrator hovers over the malicious appointment entry in the calendar.

An unauthenticated attacker can inject arbitrary JavaScript code into booking entries via customer name fields. This malicious script executes in the context of the administrator's browser when they access the Calendar page and interact with the injected booking entry. The impact includes potential theft of administrator session cookies or other sensitive information accessible via script execution. The CVSS score of 7.2 (high) reflects the network attack vector, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid accessing the Calendar page or interacting with untrusted booking entries. Monitoring for plugin updates and applying official patches once released is recommended. No official fix or temporary workaround is currently documented.