CVE-2026-40791: WP Time Slots Booking Form XSS Flaw

CVE-2026-40791 Overview

CVE-2026-40791 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin WP Time Slots Booking Form in versions up to and including 1.2.46. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and allows attackers to inject arbitrary scripts that execute in a victim's browser session. Exploitation requires user interaction, such as clicking a crafted link, but does not require authentication or prior access to the WordPress site. Successful attacks can lead to session hijacking, credential theft, administrative account takeover, and redirection to attacker-controlled infrastructure.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of WordPress site visitors and administrators, enabling account takeover and content tampering across vulnerable installations.

Affected Products

WP Time Slots Booking Form plugin for WordPress
All versions up to and including 1.2.46
WordPress sites running the plugin with default configuration

Discovery Timeline

2026-06-15 - CVE-2026-40791 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40791

Vulnerability Analysis

The WP Time Slots Booking Form plugin fails to properly neutralize user-supplied input before reflecting it back into HTML responses. An attacker can craft a malicious URL or form payload containing JavaScript that the plugin renders without sufficient sanitization or output encoding. When a victim interacts with the crafted request, the injected script executes in the victim's browser under the origin of the vulnerable WordPress site.

The scope change indicated by the CVSS vector means the injected script can affect resources beyond the vulnerable component, including the broader WordPress administrative interface. Because no authentication is required to deliver the payload, attackers can target site visitors and administrators directly through phishing or malicious links.

Root Cause

The root cause is missing or insufficient output encoding on parameters processed by the booking form. User-controlled values reach HTML rendering paths without being escaped through WordPress functions such as esc_html(), esc_attr(), or wp_kses(). This allows raw <script> tags and HTML event handlers to be embedded into the response.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter and distributes it through email, social media, or compromised sites. When a logged-in WordPress administrator clicks the link, the script executes with the administrator's privileges. Typical payloads exfiltrate session cookies, perform actions through the WordPress REST API, or inject persistent backdoors via plugin or theme editors.

For full technical details, see the Patchstack XSS Vulnerability Advisory.

Detection Methods for CVE-2026-40791

Indicators of Compromise

HTTP requests to WP Time Slots Booking Form endpoints containing <script>, javascript:, or onerror= strings in query parameters
Outbound browser requests from administrator sessions to unfamiliar external domains shortly after clicking inbound links
Unexpected creation of WordPress administrator accounts or modifications to plugin and theme files
Anomalous entries in WordPress access logs referencing booking form URLs with URL-encoded payloads

Detection Strategies

Inspect web server access logs for booking form requests containing encoded HTML or JavaScript syntax such as %3Cscript%3E or %22onmouseover%22
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns against /wp-content/plugins/wp-time-slots-booking-form/ paths
Use WordPress security scanners to enumerate installed plugin versions and flag instances at or below 1.2.46
Correlate referer headers and user-agent strings to identify suspicious link-driven sessions hitting the plugin

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or WAF and forward events to a centralized SIEM
Monitor administrator account creation, role changes, and plugin file modifications in near real time
Track browser security events such as Content Security Policy (CSP) violations reported by site visitors

How to Mitigate CVE-2026-40791

Immediate Actions Required

Update the WP Time Slots Booking Form plugin to a version newer than 1.2.46 as soon as the vendor releases a patched build
If no patched version is available, deactivate and remove the plugin from production WordPress installations
Force a password reset and session invalidation for all administrator accounts that may have clicked external links during the exposure window
Audit user accounts, plugins, and themes for unauthorized changes introduced during the vulnerability window

Patch Information

At the time of publication, refer to the Patchstack XSS Vulnerability Advisory for the latest fixed version and vendor guidance. Apply updates through the WordPress plugin manager or via WP-CLI to ensure consistent deployment across sites.

Workarounds

Deploy a WAF rule that blocks requests to booking form endpoints containing HTML tag characters or JavaScript event handlers
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict access to the booking form to authenticated users or specific IP ranges using WordPress access control plugins
Enable HTTP-only and Secure flags on WordPress session cookies to limit the impact of script-based cookie theft

bash

# Example WP-CLI commands to update the plugin and audit administrators
wp plugin update wp-time-slots-booking-form
wp plugin list --status=active --field=name,version
wp user list --role=administrator --fields=ID,user_login,user_registered