CVE-2026-59558

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Booking Calendar versions up to 11.4.2, allowing attackers to inject malicious scripts into web pages viewed by users. This could lead to session hijacking, data theft, or other malicious actions impacting user security. Organizations using affected versions of Booking Calendar should prioritize patching this vulnerability to mitigate potential exploitation risks.