CVE-2026-81798

CVE-2026-81798 is a DOM-based cross-site scripting (CWE-79) flaw in the Easy Appointments plugin for WordPress, affecting all versions from the first release through 4.0.2.1. Because it is DOM-based, the malicious input is handled in the victim's browser rather than sanitized server-side: an attacker can craft a malicious link or page parameter that, when loaded by a visitor or logged-in user on a page embedding the booking functionality, causes arbitrary JavaScript to execute in that browser session. A successful attack runs script with the victim's origin and privileges, which can allow the attacker to hijack the session, redirect the victim, or perform actions (such as admin actions if the victim is an administrator) under their identity. The CVSS score of 7.1 (high) with scope change reflects the unauthenticated, network-reachable nature and the cross-context impact, though user interaction is required. There is currently no known public proof-of-concept, no listing in CISA's Known Exploited Vulnerabilities catalog, and a low EPSS probability (~0.1%) of exploitation in the next 30 days.

What to do: Update Easy Appointments to a release later than 4.0.2.1 as soon as feasible. Until patched, review whether the booking widget is embedded on public pages and consider virtual patching (WAF rules or CSP) to limit injection via crafted URLs and page parameters. Since no public PoC or in-the-wild exploitation is known, treat as standard patching priority rather than an emergency, but monitor for emerging exploit details.