Düşük CVSS 3.5
CVE-2026-105258: CVE-2026-105258: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Özet bilgiler
- CVSS v3.1
- 3.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - EPSS
- %0,17 (yüzdelik 7)
- CWE
- CWE-79
- Yama
- Yok / bilinmiyor