CVE-2026-111727Published
Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111727 · Microsoft / collected KEV context
cve-program · CVE-2026-111727
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0e4753-222a-421f-a830-58f6af055dd8?source=cve
- https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_scheduler.inc.php#L194
- https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_go.inc.php#L690
- https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_go.inc.php#L102
- https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_go.inc.php#L616
- https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.4.05/inc/cpabc_apps_on.inc.php#L398
- https://plugins.trac.wordpress.org/log/appointment-booking-calendar/
- https://plugins.trac.wordpress.org/changeset/3750835/appointment-booking-calendar/trunk/inc/cpabc_scheduler.inc.php
Related operational evidence
Explicit CVE identifiers- Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter · Newly collected advisory · 28 Oct 2026