CVE-2026-6286

Amelia (the 'Booking for Appointments and Events Calendar' WordPress plugin) versions up to and including 2.2 are vulnerable to unauthenticated stored cross-site scripting (CWE-79), rated 7.2 High on CVSS 3.1. The plugin's AddBookingCommand explicitly skips nonce verification, so unauthenticated visitors can submit booking data, while customer first and last name fields are only passed through sanitize_text_field(), which strips HTML tags but preserves double quotes. Those names are later rendered in the administrative Calendar view, where a FullCalendar eventContent callback interpolates them into JavaScript template literals and writes them via innerHTML without HTML entity encoding, allowing a double-quoted name to break out of the title attribute and inject arbitrary event handlers. An unauthenticated attacker gains the ability to persist malicious web scripts that execute in an administrator's browser session when the admin opens the Calendar page and hovers over the crafted appointment; any WordPress site running Amelia 2.2 or earlier is affected. No public proof-of-concept is known, the flaw is not listed in CISA KEV, and an EPSS of 0.4% (37th percentile) indicates low expected near-term exploitation.

What to do: Update the Amelia plugin to the first release newer than 2.2 as soon as it is available (the advisory data does not specify a fixed version number) and verify the installed version on the WordPress Plugins screen. Until patched, consider WAF or virtual-patching rules that strip double quotes or event-handler patterns from customer name fields submitted to the booking endpoint, and audit stored customer first/last names for injected quote characters or handler strings. Since no public exploit is known and EPSS is low, treat this as patch-priority rather than an emergency, and monitor vendor or Wordfence advisories for a patched release.