CVE-2026-93875

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.

• CWE-79

• https://crocoblock.com/changelog/?plugin=jet-appointments-booking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/758f9402-33f4-40a6-a021-bf689d3b4a1b?source=cve

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93869Cotonti through 1.0.0 contains an open redirect vulnerabilit…6.1
• CVE-2026-9387A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
• CVE-2026-93870Cotonti through 1.0.0 fails to validate anti-CSRF tokens in …4.3
• CVE-2026-93871Cotonti through 1.0.0 fails to validate redirect destination…5.4
• CVE-2026-93872Cotonti 1.0.0 passes the base64-decoded cb parameter to unse…7.5
• CVE-2026-93873Cotonti through 1.0.0 fails to validate anti-CSRF tokens in …4.3
• CVE-2026-9388A weakness has been identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-93880The Greenshift – animation and page builder blocks plugin fo…6.1
• CVE-2026-93882The LearnPress – WordPress LMS Plugin for Create and Sell On…7.5
• CVE-2026-93884Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-9389A security vulnerability has been detected in Tenda F456 1.0…8.8
• CVE-2026-93894In Vinyl Cache before 9.0,2, workspace buffer overflow vulne…2.3