CVE-2026-93875

Published 2 October 2026 · tracked since 3 October 2026

Description

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-103622 HIGH 8.8
• CVE-2026-103625 HIGH 8.8
• CVE-2026-90970 CRITICAL 9.9
• CVE-2026-39600 MEDIUM 4.7
• CVE-2026-104638 MEDIUM 5.3
• CVE-2026-104625 MEDIUM 6.3
• CVE-2026-104637 HIGH 7.3
• CVE-2026-19652 CRITICAL 9.8
• CVE-2026-104613 MEDIUM 6.3
• CVE-2026-104614 MEDIUM 6.3

→ Open the live CVE board · all tools