CVE-2026-91847: Unknown Online Scheduling And Appointment Booking System

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

Affected products

• Unknown Online Scheduling And Appointment Booking System: from 28.1, before 28.2 (fixed in 28.2)

Published 2026-09-19. Last modified 2026-09-21.