Threats Tagged 'cve-2026-6286'

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw in versions up to and including 2.2. This vulnerability arises from an authentication bypass that allows unauthenticated users to submit booking data with malicious payloads in customer name fields. The plugin sanitizes input by removing HTML tags but preserves special characters such as double quotes, which are then improperly encoded when rendered in the administrative Calendar view. This enables attackers to inject JavaScript that executes when an administrator views and interacts with the malicious booking entry.

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw in versions up to and including 2.2. This vulnerability arises from an authentication bypass that allows unauthenticated users to submit booking data with malicious payloads in customer name fields. The plugin sanitizes input by removing HTML tags but preserves special characters like double quotes, which are then improperly embedded into JavaScript template literals and rendered via innerHTML without proper encoding. As a result, attackers can inject scripts that execute when an administrator views the Calendar page and interacts with the malicious booking entry.