CVE-2026-52838 Details
Description
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.
A stored cross-site scripting vulnerability has been identified in Easy!Appointments versions prior to 1.6.0. The issue arises from the 'disable_booking_message' setting, which allows administrators to input custom messages via a rich-text editor. This message is then displayed on the public booking page without any sanitization, enabling the injection of HTML or JavaScript. An authenticated administrator can exploit this by inserting malicious scripts that are executed by unauthenticated visitors when they access the booking page.
Users can update to Easy!Appointments version 1.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae | [email protected] | Source CodeVendor |
| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Easy!Appointments | <= 1.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |