DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-52838: CVE-2026-52838: Stored Cross-Site Scripting via Booking Disabled Message in Easy!Appointments

#security #cve #cybersecurity

CVE-2026-52838: Stored Cross-Site Scripting via Booking Disabled Message in Easy!Appointments

Vulnerability ID: CVE-2026-52838
CVSS Score: 2.6
Published: 2026-07-29

This report provides a comprehensive technical teardown of CVE-2026-52838 (GHSA-996f-334j-67g7), a stored Cross-Site Scripting (XSS) vulnerability in Easy!Appointments. The flaw occurs in how the application manages the 'booking disabled' custom message configuration, allowing high-privileged administrators to persist unsanitized payloads that execute on unauthenticated guest landing pages.

TL;DR

A stored Cross-Site Scripting vulnerability in Easy!Appointments prior to version 1.6.0 allows authenticated administrators to store arbitrary JavaScript payloads in the booking settings. These payloads execute automatically in the browser context of unauthenticated visitors when the application is configured in booking disabled mode.

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS v3.1 Score: 2.6
  • EPSS Score: 0.00184
  • Impact: Stored Cross-Site Scripting
  • Exploit Status: None / No Public PoC
  • KEV Status: Not Listed

Affected Systems

  • Easy!Appointments
  • easyappointments: < 1.6.0 (Fixed in: 1.6.0)

Code Analysis

Commit: 629a041

Implement pure_html sanitization for booking disabled messages to prevent cross-site scripting.

Mitigation Strategies

  • Upgrade Easy!Appointments to version 1.6.0 or higher.
  • Apply manual template-level output sanitization using the pure_html helper function.
  • Implement a robust Content Security Policy (CSP) to block the execution of inline JavaScript payloads.

Remediation Steps:

  1. Determine the current version of the Easy!Appointments installation.
  2. Back up the database and existing application directory.
  3. Download the 1.6.0 release from the official repository.
  4. Deploy the updated codebase, ensuring files in the application/views and application/controllers directories are overwritten.
  5. Validate the fix by attempting to input HTML tags in the booking message configuration as an administrator and verifying they are sanitized on the guest page.

References

Read the full report for CVE-2026-52838 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)