Description

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-12T13:16:50.193Z",
  "pubdate": "2026-09-12T13:16:50.193Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar plugin for WordPress contains a critical Stored Cross-Site Scripting (XSS) vulnerability in its Elementor integration.\nThe vulnerability originates from inadequate input sanitization and output escaping protocols applied to the 'load_manually' parameter within the plugin's widget render() methods.\nThis security flaw allows authenticated users with Contributor-level permissions or higher, who possess access to the Elementor page builder, to inject malicious client-side scripts.\nWhen a user or administrator subsequently views a page containing the manipulated widget, the injected script executes within the context of the victim's browser session.\nThe impact includes potential account takeover, session hijacking, and the unauthorized execution of actions on behalf of the victim.\nGiven that this vulnerability allows for the persistence of malicious payloads within the WordPress database, it poses a significant risk to site integrity and user data security.\nThe vulnerability affects all versions of the plugin up to and including 2.4.9, with a partial patch released in version 2.4.8.",
  "technicalDetails": "The root cause of this vulnerability is the failure to perform rigorous input validation and context-aware output encoding on the 'load_manually' parameter handled by the plugin's Elementor widgets.\nThe vulnerability is localized within the render() methods of the widget classes responsible for displaying appointment or event data. When an attacker modifies the Elementor widget configuration, they can pass arbitrary string data, including crafted JavaScript payloads, into the 'load_manually' parameter.\nBecause the application directly echoes this parameter into the DOM of the front-end page without applying appropriate escaping functions (such as esc_js, esc_attr, or wp_kses), the browser interprets the injected script as legitimate application code.\nThe exploitation flow begins with an attacker who holds Contributor privileges, which is the minimum requirement to utilize the Elementor editor on WordPress. The attacker inserts or edits a Booking for Appointments and Events Calendar widget on a page or post. Within the widget settings, they inject a malicious payload into the vulnerable 'load_manually' field.\nOnce the page is saved, the malicious payload is stored permanently in the WordPress wp_posts or wp_postmeta tables. Upon any visitor, including high-privileged users like administrators, loading the affected page, the server-side response includes the injected script. The victim's browser executes this script automatically in the context of the WordPress site.\nThe execution of arbitrary JavaScript allows for several post-exploitation actions, including the exfiltration of authentication cookies via document.cookie, performing unauthorized AJAX requests to administrative endpoints, or redirecting users to malicious external domains. Because the script executes in the victim's session, the attacker can leverage the victim’s existing permissions to modify site content, create new administrative users, or delete existing data.\nThis vulnerability is persistent; the payload remains active until it is manually removed from the widget configuration or the plugin code is hardened to sanitize the input properly. The presence of a partial patch in version 2.4.8 suggests that the development team attempted to address input handling, but the persistence of the vulnerability in version 2.4.9 indicates that existing sanitization routines remain insufficient for the specific widget implementation."
}