Security Alert Summary
The Smart Appointment & Booking plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its AJAX handling that can be abused by authenticated users with Subscriber-level access and above to inject JavaScript into stored content. Injected scripts will execute when a user views an affected page.
CVE Details
- CVE ID: CVE-2026-0742
- Affected component: Smart Appointment & Booking plugin for WordPress
- Affected versions: All versions up to and including 1.0.7
- Published: February 4, 2026 at 9:15:52 AM UTC
- Last modified: February 4, 2026 at 4:33:44 PM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM — Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges: Requires an authenticated user with low privileges (Subscriber-level access or above). User interaction is not required to trigger execution after injection.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation — Stored XSS)
Technical Details
The vulnerability is a stored cross-site scripting issue caused by insufficient input sanitization and output escaping of user-supplied attributes handled by the plugin. The CVE description specifically identifies the AJAX action saab_save_form_data as the entry point where attacker-controlled data can be stored.
Because user-supplied attributes are not properly sanitized before being persisted and later rendered, an authenticated user (Subscriber or higher) can submit payloads that are saved and later served to other users. When a victim visits a page containing the injected content, the browser will execute the injected script in the context of the site, consistent with stored XSS behaviour.
The impact is limited to what stored XSS normally permits: script execution in the context of the affected site (for example, reading or manipulating content available to the browser, stealing cookies or tokens accessible to page scripts, or performing actions on behalf of the user within the limits of their privileges). The CVE entry attributes the root cause to missing or insufficient input/output handling rather than to an authentication bypass or unauthenticated remote code execution.
How This Could Impact Your Website
Consider a typical multi-user WordPress site where the site owner manages content and internal staff and external contractors contribute. An external contractor or a staff member with Subscriber or Contributor-level access could submit form data or attributes that include a malicious script. That script would be stored by the plugin and then executed when other users — including editors, administrators, or regular visitors — view the affected page.
Practical consequences may include disclosure of information available to the visiting user’s browser (such as accessible session tokens or profile data), unwanted actions performed in the context of a logged-in user, and increased risk of targeted phishing or social engineering using harvested addresses or session information.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (If a fixed version is not specified in this CVE entry, check the plugin author or WordPress.org plugin page for updates.)
- Review and reduce unnecessary user roles and capabilities, especially for contributors and subscribers.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site to reduce attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected content changes or new stored content originating from low-privilege accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/smart-appointment-booking/tags/1.0.7/inc/admin/class.saab.admin.action.php#L1203
- https://plugins.trac.wordpress.org/browser/smart-appointment-booking/tags/1.0.7/inc/front/class.saab.front.action.php#L2189
- https://plugins.trac.wordpress.org/browser/smart-appointment-booking/trunk/inc/admin/class.saab.admin.action.php#L1203
- https://plugins.trac.wordpress.org/browser/smart-appointment-booking/trunk/inc/front/class.saab.front.action.php#L2189
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3450387%40smart-appointment-booking&new=3450387%40smart-appointment-booking&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bf332c0d-5481-412d-b44a-b3de346d7b60?source=cve
