CVE-2026-93875 is a high severity (CVSS 7.2) stored cross-site scripting flaw in the JetAppointment plugin for WordPress, all versions up to and including 2.5.2.1. Unauthenticated visitors can inject script that runs in an administrator's browser. Update to the patched release listed in the vendor changelog.
What's affected
The record lists all versions up to and including 2.5.2.1 as affected. The weakness is CWE-79, cross-site scripting. The cause, per the record, is insufficient input sanitization and output escaping on the friendlyTime parameter.
The record says the payload is stored in the plugin's appointment metadata table through the unauthenticated jet_engine_form_booking_submit endpoint, and runs in the administrator's browser when the appointment details popup opens in the WordPress admin panel.
I could not read the Crocoblock changelog or the Wordfence entry, both of which load their content with scripts, so I cannot confirm the exact fixed version number. Version 2.5.2.1 is the last affected release, so you want a later one. Confirm in the changelog.
How to check if you're exposed
List the plugin and its version with WP-CLI.
wp plugin list | grep -i jet
wp plugin get jet-appointments-booking --field=version
Or open the Plugins page in the WordPress admin and read the version under JetAppointment. Version 2.5.2.1 or lower is affected.
Then look at the appointment records in the admin for unusual values in time related fields, such as markup in place of plain text.
What to do now
- Open the Crocoblock changelog for the plugin and update to the release that lists the fix. Take a backup first.
- Review recent appointments for markup in time fields. Do not open suspicious entries in the details popup until the plugin is updated.
- Ask administrators to avoid the appointment details view until the update is applied.
- If you cannot update right away, consider deactivating the plugin or limiting access to the booking form submit endpoint with your firewall.
- Enable a Content Security Policy on the admin area where your setup allows it.
Why it matters
Stored XSS in an administrative view is attractive because the person who triggers it is the site administrator. A script running in that session can act with their rights: create users, change settings or install plugins. CWE-79 is a failure to escape output for the page it lands in, and it appears often in booking and form plugins that accept free text from the public.
The record does not report exploitation, and the CVE is not in CISA's catalog. The attacker needs no account, so exposure depends on how many people can reach your booking form and how often administrators open appointment details.
Quick check
Does a visitor need an account?
No. The record says unauthenticated attackers can inject the payload through the booking submit endpoint.
Which version is fixed?
The record lists 2.5.2.1 as the last affected version. Check the Crocoblock changelog for the exact fixed number.
Sources
Last reviewed: 18 October 2026.
