CVE-2026-65514

The Appointment Hour Booking plugin versions up to 1.5.86 are vulnerable to a Contributor Cross Site Scripting (XSS) flaw, which could allow attackers to inject malicious scripts into web pages viewed by other users. This vulnerability poses a medium risk, as it can lead to unauthorized actions or data exposure for users with contributor-level access. Organizations using this plugin should prioritize patching or upgrading to mitigate potential exploitation risks.