CVE-2026-40791: WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability affects the WP Time Slots Booking Form WordPress plugin at version 1.2.46 and earlier. The flaw is reachable over the network, requires no authentication, but does require a victim to interact with a malicious link or page. Successful exploitation lets an attacker inject and run arbitrary JavaScript in a victim's browser, enabling session theft, page content manipulation, or unauthorized actions on behalf of the user. No fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The affected plugin endpoint is exposed over the network, meaning an attacker can send a crafted request from anywhere on the internet without needing local or adjacent access.

• AuthenticationNot required

  No account or session credentials are needed; the vulnerability is reachable by any unauthenticated user.

• Victim interactionRequired

  A victim must follow a crafted link or visit an attacker-controlled page that triggers the malicious script, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors beyond getting the victim to interact.

Blast Radius

• Reads session cookies or authentication tokens stored in the victim's browser, enabling account takeover without credential theft.
• Modifies visible page content in the victim's browser session, allowing phishing overlays or fake login prompts to be injected.
• Performs authenticated actions (form submissions, settings changes) on the WordPress site on behalf of the victim using their active session.