This vulnerability (CVE-2026-65514) is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to cross-site scripting (XSS). It affects Appointment Hour Booking software by codepeople in versions up to 1.5.86. The CVSS 3.1 vector shows it requires network access, low attack complexity, privileges, and user interaction, with a scope change and low impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with limited privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application. This may lead to partial compromise of confidentiality, integrity, and availability of the application or user data. However, the impact is rated medium and no active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates and apply patches once available. Until then, consider restricting user input or applying web application firewall rules to mitigate potential exploitation.