CVE-2026-6286: Amelia WordPress Plugin Stored XSS Vulnerability

CVE-2026-6286 Overview

CVE-2026-6286 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress. Versions up to and including 2.2 are affected. The flaw stems from an authentication bypass in the AddBookingCommand handler combined with insufficient output encoding in the administrative Calendar view. Unauthenticated attackers can submit booking data containing malicious payloads in the customer name fields. When an administrator loads the Calendar page and hovers over the crafted appointment, injected JavaScript executes in the administrator's browser session.

Critical Impact
Unauthenticated attackers can inject arbitrary JavaScript that executes with administrator privileges in the WordPress admin dashboard, enabling session hijacking and privileged actions.

Affected Products

Booking for Appointments and Events Calendar – Amelia plugin for WordPress
All versions up to and including 2.2
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2026-08-28 - CVE-2026-6286 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-6286

Vulnerability Analysis

The vulnerability is a stored XSS issue that chains two distinct weaknesses. First, the AddBookingCommand class explicitly skips nonce verification at Command.php line 186, permitting unauthenticated requests to submit booking data through the REST endpoint handled by AddBookingCommandHandler.php. Second, the front-end administrative Calendar view renders customer-supplied strings into JavaScript template literals without HTML entity encoding.

While BookingApplicationService.php (lines 302-308) applies sanitize_text_field() to the firstName and lastName fields, this WordPress function only strips HTML tags. It preserves special characters, including double quotes, ampersands, and angle-bracket-adjacent syntax. An attacker submits a name value such as " onmouseover="alert(document.cookie)" which passes sanitization intact.

When an administrator opens the Calendar view, the FullCalendar eventContent callback in redesign/dist/index.js at line 199 interpolates the stored name directly into a template literal and assigns it via innerHTML. The injected quote breaks out of the title attribute context, and the appended onmouseover handler executes when the admin hovers over the event.

Root Cause

Two defects combine to create the vulnerability. sanitize_text_field() is used as an XSS defense but does not encode HTML-significant characters for attribute contexts. Rendering user-controlled data via innerHTML without esc_attr() or equivalent JavaScript encoding leaves attribute-boundary injection viable.

Attack Vector

The attack requires no authentication and no user interaction beyond an administrator visiting the Calendar page. An attacker submits a booking through the public-facing booking form with a malicious payload embedded in the customer name. The payload is stored in the database and executed in the administrator's browser context on next Calendar load, granting the attacker access to session cookies and admin-privileged actions.

Exploitation details are documented in the Wordfence Vulnerability Report and the fix is visible in Changeset #3499608 and Changeset #3505826.

Detection Methods for CVE-2026-6286

Indicators of Compromise

Booking records where firstName or lastName fields contain double quotes, angle brackets, or JavaScript event handler substrings such as onmouseover=, onerror=, or onload=.
POST requests to Amelia booking REST endpoints (for example /wp-json/amelia/v1/bookings) from unauthenticated sources containing suspicious name payloads.
Outbound requests from administrator browsers to unknown domains shortly after Calendar page access.

Detection Strategies

Query the WordPress database wp_amelia_users and related booking tables for name fields matching the regex pattern ["'<>]|on\w+\s*=.
Inspect web server access logs for anonymous POSTs to Amelia booking endpoints followed by administrator sessions accessing /wp-admin/admin.php?page=wpamelia-calendar.
Deploy a Web Application Firewall (WAF) rule to flag HTML-significant characters submitted to the booking API.

Monitoring Recommendations

Alert on any WordPress admin session that triggers unexpected JavaScript execution or DOM modifications on plugin management pages.
Log and review new booking submissions daily until the plugin is patched.
Monitor for privilege changes, new administrator accounts, or plugin modifications following Calendar page access by admins.

How to Mitigate CVE-2026-6286

Immediate Actions Required

Update the Amelia plugin to the patched release (post-changeset 3505826) as published on the WordPress plugin repository.
Audit existing booking records and remove or sanitize any entries containing suspicious characters in customer name fields.
Rotate administrator session cookies and passwords if Calendar pages were accessed while the vulnerability was present.

Patch Information

The vendor addressed the vulnerability in commits published as Changeset #3499608 and Changeset #3505826. Site administrators should upgrade to a version later than 2.2 through the WordPress plugin auto-update mechanism or by manual replacement of the plugin directory.

Workarounds

Deactivate the Amelia plugin until the patched version is deployed if immediate updating is not possible.
Restrict access to Amelia booking API endpoints via WAF rules that block requests containing quote characters or on*= handler syntax in name parameters.
Configure Content Security Policy (CSP) headers on the WordPress admin interface to block inline event handler execution.

bash

# Example WAF rule (ModSecurity syntax) blocking XSS payloads in Amelia booking submissions
SecRule REQUEST_URI "@contains /wp-json/amelia" \
  "chain,id:1026286,phase:2,deny,status:403,msg:'CVE-2026-6286 XSS attempt'"
SecRule ARGS_NAMES|ARGS "@rx (?i)(on\w+\s*=|<script|javascript:|[\"'])" \
  "t:none,t:urlDecode"