CVE-2026-6286: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in melograno Booking for Appointments and Events Calendar – Amelia

CVE-2026-6286 is a stored cross-site scripting vulnerability in the Booking for Appointments and Events Calendar – Amelia WordPress plugin, affecting versions up to and including 2.2. The issue stems from an authentication bypass in the AddBookingCommand that skips nonce verification, allowing unauthenticated submission of booking data. Although the plugin applies sanitize_text_field() to customer first and last name fields, this function only removes HTML tags and preserves special characters like double quotes. These characters are then interpolated directly into JavaScript template literals in the administrative Calendar's FullCalendar eventContent callback and rendered via innerHTML without proper HTML entity encoding. This improper neutralization allows an attacker to inject malicious scripts that execute when an administrator hovers over the crafted booking event in the Calendar view.

An unauthenticated attacker can inject arbitrary JavaScript code into booking entries via customer name fields. This code executes in the context of the administrator's browser when they access the Calendar page and interact with the malicious event, potentially leading to session hijacking, credential theft, or other malicious actions. The vulnerability has a CVSS 3.1 score of 7.2 (High severity) with network attack vector, no privileges required, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should limit access to the Calendar page to trusted users only and consider disabling or restricting the vulnerable plugin. Monitoring for suspicious booking entries and avoiding interaction with untrusted booking data in the administrative interface can reduce risk.