CVE-2026-96573 is a stored DOM-based cross-site scripting vulnerability in the Appointment Hour Booking – Booking Calendar WordPress plugin. The vulnerability exists in all versions up to and including 1.5.97 due to improper neutralization of input during web page generation (CWE-79). Specifically, the Booking Form Single-Line Field processed by the Schedule Calendar List Renderer does not properly sanitize or escape input, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation depends on the 'list_readmore_numberofwords' parameter being configured with a positive integer; if set to 0 (the default), the vulnerability is not exploitable through this vector.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary web scripts in the context of affected pages, potentially leading to information disclosure or user session compromise. The vulnerability has a CVSS 3.1 base score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

No official patch or fix is currently documented. Users should verify the configuration of the 'list_readmore_numberofwords' parameter; leaving it at the default value of 0 mitigates exploitation via this vulnerability. Monitor the vendor's advisory channels for updates or patches. Until a fix is available, consider restricting access to affected plugin features or disabling the plugin if feasible.