CVE-2026-52838: Easy!Appointments Stored XSS Vulnerability

CVE-2026-52838 Overview

CVE-2026-52838 is a stored Cross-Site Scripting (XSS) vulnerability in Easy!Appointments, a self-hosted appointment scheduling application. Versions prior to 1.6.0 allow authenticated administrators to set a custom "booking disabled" message through the booking settings page. The application stores this value in the disable_booking_message setting and renders it directly in the public booking_message view without escaping or sanitization. An administrator can inject HTML or JavaScript that executes in every unauthenticated visitor's browser when booking is disabled. The issue is fixed in version 1.6.0 and tracked under [CWE-79].

Critical Impact
An authenticated administrator can plant persistent JavaScript that runs in every visitor's browser session, enabling session theft, phishing overlays, or drive-by redirects.

Affected Products

Easy!Appointments versions prior to 1.6.0
application/controllers/Booking_settings.php controller
application/views/pages/booking_message.php view

Discovery Timeline

2026-07-14 - CVE-2026-52838 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-52838

Vulnerability Analysis

The flaw is a stored XSS in the booking settings workflow. Administrators use a rich-text editor to configure the disable_booking_message setting. The controller accepts the raw value from the request and persists it without HTML sanitization. When an administrator enables the disabled-booking mode, the public booking page renders the stored value using <?= vars('message_text') ?> with no output encoding. Any script or event handler embedded in the message executes in the context of the site origin for every visitor who lands on the page.

Root Cause

The root cause is missing output encoding in the booking_message.php view combined with the absence of HTML sanitization on stored input. The setting was treated as trusted content because only administrators can write to it, ignoring the risk that a compromised or malicious administrator account can weaponize this field against every anonymous visitor.

Attack Vector

Exploitation requires an authenticated administrator to save a crafted payload in the disabled-booking message field and toggle the disabled-booking mode. Visitors who open the public booking URL then execute the attacker-controlled payload. User interaction is limited to visiting the page, and the vulnerability crosses a trust boundary from the admin scope to unauthenticated users.

php

// Fix in application/controllers/Booking_settings.php
check('booking_settings', 'array|null');

$rich_text_settings = [
    'disable_booking_message',
];

$settings = request('booking_settings', []);

foreach ($settings as $setting) {
// Source: https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae

php

// Fix in application/views/pages/booking_message.php
<div class="mb-5">
    <h4 class="mb-5"><?= vars('message_title') ?></h4>

    <p><?= pure_html(vars('message_text')) ?></p>
</div>
// Source: https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae

The patch introduces a rich_text_settings allowlist in the controller and wraps the rendered message with pure_html() in the view to strip dangerous markup.

Detection Methods for CVE-2026-52838

Indicators of Compromise

Unexpected <script>, <iframe>, on* event handlers, or javascript: URIs in the stored disable_booking_message setting value.
Public booking page responses containing script tags or external resource references that do not appear in the application's default templates.
Administrator audit logs showing edits to booking settings from unfamiliar IP addresses or user agents.

Detection Strategies

Query the settings table for the disable_booking_message row and scan its value for HTML tags, event handlers, and encoded script payloads.
Diff current view output for /index.php/booking_message against a known-good baseline to spot injected markup.
Correlate administrator sessions that modified booking settings with subsequent visitor traffic spikes to the public booking page.

Monitoring Recommendations

Enable web server access logging for the booking settings endpoint and public booking message view, retaining request bodies where policy permits.
Deploy Content Security Policy (CSP) headers in report-only mode to surface unexpected inline scripts on booking pages.
Alert on any change to the disable_booking_message value through database change auditing.

How to Mitigate CVE-2026-52838

Immediate Actions Required

Upgrade Easy!Appointments to version 1.6.0 or later, which introduces the pure_html() sanitizer on the booking message output.
Review the current stored value of disable_booking_message and reset it to a plain-text string if any HTML is present.
Rotate administrator credentials and review account activity for unauthorized booking settings changes.

Patch Information

The fix is delivered in Easy!Appointments 1.6.0 via commit 629a0415f54f75556c17f4f5d9c77fda1fdbdeae. Details are available in the GitHub Security Advisory GHSA-996f-334j-67g7 and the GitHub commit. The patch adds disable_booking_message to a rich_text_settings allowlist in Booking_settings.php and renders the value through pure_html() in booking_message.php.

Workarounds

Disable the "booking disabled" mode until upgrading, so the vulnerable view is not served to visitors.
Restrict administrator access with strong authentication and IP allowlisting to reduce the risk of a malicious or compromised admin abusing the field.
Deploy a strict Content Security Policy that blocks inline scripts on the public booking page as a defense-in-depth control.

bash

# Upgrade Easy!Appointments to the patched release
cd /var/www/easyappointments
git fetch --tags
git checkout 1.6.0
composer install --no-dev --optimize-autoloader
php index.php console migrate