What’s Vulnerable › Vulnerabilities

CVE-2026-52838: Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

• Severity: low (CVSS 2.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-79

Description

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.

Affected products

• alextselegidis/easyappointments: before 1.6.0

References

• https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7

Get alerted when CVE-2026-52838 or the next vulnerability affects your stack