Codepeople Appointment Hour Booking – Booking Calendar vulnerabilities

2 CVEs affecting Codepeople Appointment Hour Booking – Booking Calendar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96573, published 2026-10-01.

More from Codepeople.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-1083, published 2026-01-28. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuration parameters in all versions up to, and including, 1.5.60…
• CVE-2026-96573, published 2026-10-01. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in…