CVE-2026-93875 describes a stored XSS vulnerability in the JetAppointment plugin for WordPress. The flaw arises from insufficient input sanitization and output escaping of the 'friendlyTime' parameter. Attackers can exploit the unauthenticated jet_engine_form_booking_submit endpoint to store malicious scripts in the wp_jet_appointments_meta database table. These scripts execute in the context of the administrator's browser when the appointment details popup is accessed in the WordPress admin interface.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the administrator's browser, potentially leading to credential theft, session hijacking, or other malicious actions within the admin context. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, restricting access to the WordPress admin panel and limiting exposure of the vulnerable endpoint may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.