CVE-2026-1083

🗓️ 28 Jan 2026 05:30:19Reported by WordfenceType

Authenticated admins can store XSS via min/max length fields in Booking Calendar up to v1.5.60.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-1083	28 Jan 202605:30	–	attackerkb
Circl	CVE-2026-1083	28 Jan 202609:34	–	circl
CNNVD	WordPress plugin Appointment Hour Booking: Cross-site scripting vulnerability	28 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-1083 Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration	28 Jan 202605:30	–	cvelist
EUVD	EUVD-2026-4866	28 Jan 202605:30	–	euvd
NVD	CVE-2026-1083	28 Jan 202606:15	–	nvd
Patchstack	WordPress Appointment Hour Booking plugin <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration vulnerability	28 Jan 202601:33	–	patchstack
Positive Technologies	PT-2026-5060	28 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-1083	29 Jan 202609:24	–	redhatcve
Vulnrichment	CVE-2026-1083 Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration	28 Jan 202605:30	–	vulnrichment

Vulners

Node

codepeople appointment_hour_booking_booking_calendarRange≤1.5.60wordpress

[
  {
    "vendor": "codepeople",
    "product": "Appointment Hour Booking – Booking Calendar",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.5.60",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/appointment-hour-booking/trunk/js/fields-admin/01_fbuilder.ftext.js
plugins	www.plugins.trac.wordpress.org/browser/appointment-hour-booking/tags/1.5.57/js/fields-admin/01_fbuilder.ftext.js
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a5cb1fea-134f-4c81-8f2f-76ee42df7f77

15 Apr 2026 00:35Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.4

EPSS0.00014

SSVC

CWE-79