CVE-2026-40791: Unauthenticated XSS in WP Time Slots Booking Form ≤1.2.46 – Patch Required

Technical summary

The vulnerability is a stored or reflected XSS flaw (CWE-79) in WP Time Slots Booking Form affecting all versions up to and including 1.2.46. The plugin fails to properly sanitize and escape user-supplied input before rendering it in web responses. Because the booking form is typically accessible to unauthenticated visitors, an attacker can craft malicious payloads and inject them through form parameters, comments, or other input vectors. The resulting JavaScript executes with the privileges of the victim's browser session, including administrative sessions if triggered against site operators.

Business impact

Compromised WordPress sites using this plugin face multiple operational and reputational risks. Attackers can harvest credentials from booking form submissions, inject malware redirects, or modify booking data to disrupt appointment scheduling. For e-commerce or service-based businesses relying on the plugin for client intake, data integrity becomes compromised. Administrative users are at heightened risk of account takeover if their sessions are hijacked through the XSS vector. Sites may also face GDPR or similar privacy law violations if customer data is exfiltrated via the vulnerability.

Affected systems

WordPress installations running WP Time Slots Booking Form plugin version 1.2.46 or earlier are affected. The plugin is accessible to any WordPress site using this component for appointment booking functionality. Because no authentication is required to exploit the vulnerability, any visitor-facing instance of the booking form represents an attack surface. The impact scope extends to both the compromised site and its users, as well as potentially to downstream services or integrations that trust booking data from the affected plugin.

Exploitability

This vulnerability is readily exploitable. No authentication is required, the attack vector is network-based, and user interaction (clicking a malicious link or visiting a compromised page) is the only barrier. The CVSS score of 7.1 (HIGH) reflects moderate complexity mitigated by the requirement for user interaction and limited impact scope per the assessment vector. Proof-of-concept exploits are likely to emerge or may already circulate, making this a practical risk for threat actors targeting WordPress sites en masse.

Remediation

The primary remediation is to update WP Time Slots Booking Form to a patched version released after 1.2.46. Site administrators should verify the latest version available from the official plugin repository or the vendor's advisory. As an interim measure, disable or restrict access to the booking form (via Web Application Firewall rules or access controls) until patching is complete. Review access logs for evidence of exploitation attempts or data exfiltration. Consider conducting a security audit of any booking data collected during the vulnerable window.

Patch guidance

Monitor the WP Time Slots Booking Form plugin repository and vendor security advisories for an updated release. Once available, apply the patch promptly through the WordPress dashboard. Test the update in a staging environment first to ensure compatibility with your theme and other plugins. After deployment, verify that the booking form remains functional and that no previously injected malicious code persists. If no official patch is released within a reasonable timeframe, evaluate alternative appointment scheduling plugins with stronger security records.

Detection guidance

Monitor web application logs and WAF logs for suspicious patterns in booking form submissions, such as script tags, event handlers (onclick, onerror, onload), or encoded JavaScript in form parameters. Look for HTTP requests containing payloads like '<script>', 'javascript:', or common XSS encodings. Review WordPress plugin logs and admin audit trails for unauthorized modifications to booking data or form configuration. Use browser developer tools or security scanning tools to inspect the rendered HTML of the booking form for unexpected script elements. Implement Content Security Policy (CSP) headers to restrict inline script execution as a defense-in-depth measure.

Why prioritize this

This vulnerability merits immediate attention because it is unauthenticated, requires only passive user interaction to exploit, affects a public-facing form component, and poses direct threats to user data and site integrity. The HIGH CVSS severity combined with the widespread use of WordPress and booking form plugins across many business sectors elevates urgency. Organizations running this plugin should treat patching as a critical priority, not a routine maintenance task.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects a network-accessible vulnerability requiring user interaction but offering low attack complexity. The attack vector (AV:N) indicates remote exploitability with no special network positioning needed. PR:N (no privileges required) and the low impact ratings on confidentiality, integrity, and availability across a changed scope (S:C) position this as a moderate-to-high risk. The score appropriately captures the practical threat: while not a system-wide catastrophic failure, the unauthenticated nature and public-facing attack surface make this a serious, actionable risk for defenders.

Frequently asked questions