CVE-2026-93875

{
  "etk_id": "ETK-2026-437",
  "cve_id": "CVE-2026-93875",
  "display_id": "CVE-2026-93875",
  "ghsa_id": "GHSA-fpfr-m3qm-9475",
  "euvd_id": "EUVD-2026-91634",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated stored cross-site scripting in JetAppointment",
  "summary": "JetAppointment for WordPress versions through 2.5.2.1 are affected by stored cross-site scripting in appointment submission data. An unauthenticated attacker may cause script to be stored and later execute when an administrator views the related appointment details. Public access to the affected booking submission path is required.",
  "mitigation": "Disable or restrict public appointment booking forms that use the affected submission path until an updated JetAppointment release is available. Review existing appointment entries before opening their details in the WordPress administration interface.",
  "vendor": "Crocoblock",
  "product": "JetAppointment",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.5.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "JetAppointment",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0818,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.669228966666665,
  "t0_at": "2026-10-02T13:29:05.089000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T13:29:05.089000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T13:29:05.089000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93875"
    }
  }
}