CVE-2026-52838: Easy!Appointments Stored XSS via Disable Booking Message
Summary
CVE-2026-52838: Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS. Affects alextselegidis/easyappointments versions < 1.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Easy!Appointments is an open-source appointment scheduling software that allows businesses, clinics, and service providers to manage bookings efficiently. It features a user-friendly interface for both administrators and clients, enabling customization of booking settings, including messages displayed to users. However, a vulnerability exists in the way the application handles custom messages, specifically the 'disable booking message', which can be exploited to execute malicious scripts.
Vulnerability Detail
The vulnerability arises from the lack of sanitization when storing and rendering the 'disable booking message' in Easy!Appointments. Administrators can input HTML or JavaScript into this field via a rich-text editor, which is then stored without any filtering. When the booking is disabled, this message is displayed on the public booking page, allowing an attacker to inject malicious scripts that execute in the browsers of all unauthenticated visitors. This can lead to various attacks, including phishing, defacement, or redirection to malicious sites.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using HTML or JavaScript in the 'disable booking message' field until the application is updated. This can help mitigate the risk of XSS attacks while a permanent fix is being implemented.
Conclusion
The CVE-2026-52838 vulnerability in Easy!Appointments poses a significant risk due to its potential for exploitation via stored XSS. Administrators are urged to update to the latest version and implement the recommended code changes to safeguard their applications against such attacks.
See every vulnerability recorded for alextselegidis/easyappointments →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into the public booking page.
An authenticated administrator can exploit this vulnerability by entering malicious content into the 'disable booking message' field.
The impacts include executing arbitrary JavaScript in visitor browsers, phishing for credentials, defacing the booking page, or redirecting users to malicious sites.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 2.6, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for alextselegidis/easyappointments.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
