Description

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies sanitize_text_field() to customer firstName and lastName fields (BookingApplicationService.php lines 302-308), this function only removes HTML tags and preserves special characters including double quotes. The vulnerability manifests in the administrative Calendar view where a FullCalendar eventContent callback interpolates customer names directly into JavaScript template literals (redesign/dist/index.js line 199) and renders them via innerHTML without proper HTML entity encoding. Because double quotes are preserved, an attacker can inject payloads like '" onmouseover="alert(document.cookie)"' to break out of the title attribute and inject malicious event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator accesses the Calendar page and hovers over the malicious appointment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T08:16:41.140Z",
  "pubdate": "2026-08-28T08:16:41.140Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar – Amelia plugin for WordPress (versions 2.2 and below) is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw originates from an authentication bypass mechanism that permits unauthenticated users to submit booking requests without performing nonce validation.\nWhile the application attempts input sanitization, the use of 'sanitize_text_field()' is insufficient as it fails to neutralize special characters such as double quotes. This oversight allows malicious actors to inject crafted JavaScript payloads into customer name fields.\nThe primary risk involves the administrative interface, where the injected payload is rendered within the Calendar view via insecure innerHTML operations. When an administrator interacts with the manipulated event data, the injected scripts execute in the context of the administrator's session. This allows unauthenticated attackers to potentially gain unauthorized administrative access, steal session cookies, or perform unauthorized actions on behalf of the administrator, posing a critical risk to the integrity and confidentiality of the WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability is a confluence of improper authentication enforcement and inadequate output sanitization. In 'Command.php' at line 186, the 'AddBookingCommand' explicitly omits nonce verification, allowing any remote user to submit booking data without an active, authenticated session. Although the 'BookingApplicationService.php' (lines 302-308) applies 'sanitize_text_field()' to 'firstName' and 'lastName' parameters, this function effectively strips only HTML tags while leaving characters like double quotes (U+0022) intact.\nThe exploitation flow begins when an unauthenticated attacker crafts a malicious payload, such as '\" onmouseover=\"alert(document.cookie)\"', and submits it via a booking request. Because the server does not enforce authentication or nonce checks, the payload is successfully stored in the database.\nThe vulnerability manifests within the administrative Calendar view. The application uses a 'FullCalendar' eventContent callback in 'redesign/dist/index.js' (line 199), which interpolates the attacker-supplied name directly into a JavaScript template literal. Because the system subsequently uses 'innerHTML' to render this template without performing proper HTML entity encoding, the browser interprets the injected double quotes as structural attributes of the HTML tag rather than literal text.\nThe attack vector is triggered when an administrator navigates to the Calendar page. As the administrator hovers over the event associated with the malicious booking, the browser executes the injected 'onmouseover' event handler. This leads to arbitrary script execution in the context of the administrative session.\nThe impact is significant: the attacker achieves Stored XSS, which can be leveraged to hijack administrative sessions, perform unauthorized site modifications, or exfiltrate sensitive data. Given the requirement for interaction, this constitutes a stored, client-side injection vulnerability that bypasses standard access control due to the insecure implementation of the booking submission command."
}