CVE-2026-52838: Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
Easy!Appointments allows administrators to define a custom “booking disabled” message through the booking settings page. That value is stored in the disable_booking_message setting via a rich-text editor and later passed directly to the public booking_message view without escaping or sanitization:
<p><?= vars('message_text') ?></p>
An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page.
References
- github.com/advisories/GHSA-996f-334j-67g7
- github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae
- github.com/alextselegidis/easyappointments/releases/tag/1.6.0
- github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7
- nvd.nist.gov/vuln/detail/CVE-2026-52838
Code Behaviors & Features
Detect and mitigate CVE-2026-52838 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →