CVE-2026-6286

Executive Summary

CVE-2026-6286 is a Stored Cross-Site Scripting (XSS) vulnerability in the Amelia plugin for WordPress, a popular booking and appointments management solution. The flaw allows unauthenticated attackers to inject arbitrary web scripts through customer name fields, which subsequently execute when a WordPress administrator accesses the Calendar view and interacts with the maliciously created appointment. The vulnerability carries a CVSS score of 7.2 (High), driven by network-based exploitation with no authentication or user interaction required, and a scope change indicating impact beyond the vulnerable component. Any WordPress site running Amelia plugin versions up to and including 2.2 is affected, potentially exposing administrative sessions, booking data integrity, and the broader WordPress installation to compromise.

Technical Analysis

The vulnerability chain in CVE-2026-6286 comprises three distinct weaknesses that, when combined, enable unauthenticated stored XSS:

Authentication Bypass (Root Cause): The attack begins with an authentication bypass in the AddBookingCommand, located in Command.php at line 186. This command explicitly skips nonce verification, which is WordPress's standard CSRF/request-origin protection mechanism. By design, nonce verification ensures that requests originate from legitimate page loads rather than external malicious sources. Skipping this check means the booking submission endpoint accepts requests from any unauthenticated source without validating whether the request is legitimate. This effectively exposes the booking creation functionality to unauthenticated attackers.

Insufficient Input Sanitization: The plugin's BookingApplicationService.php (lines 302-308) applies sanitize_text_field() to customer firstName and lastName fields. While this WordPress function removes HTML tags and strips line breaks, it does not remove double quote characters (") or encode HTML entities. This is a critical gap: the function preserves special characters that are significant in HTML attribute contexts. An attacker can therefore submit a customer name containing double quotes, which will persist to the database without proper neutralization.

Unsafe DOM Interpolation and Rendering: The payload is rendered in the administrative Calendar view. The eventContent callback in redesign/dist/index.js (line 199) interpolates customer names directly into JavaScript template literals. These template literals are used to construct HTML that is then injected via innerHTML. The sequence is as follows:

1. Customer name stored with double quotes intact.
2. Calendar view loads appointments; the eventContent callback builds an HTML string.
3. The customer name is inserted into a title attribute context within the template literal.
4. Because double quotes are preserved, an attacker-supplied value can close the title attribute early.
5. The remaining attacker payload injects additional HTML attributes, such as event handlers (e.g., onmouseover).

When the administrator hovers over the rendered appointment, the injected event handler executes in the context of the WordPress admin session.

The attack requires no authentication and no user interaction beyond a standard hover action by the admin. Because the payload is stored server-side and rendered dynamically, the XSS is persistent (stored) rather than reflected.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker locates WordPress sites running the Amelia plugin version 2.2 or earlier. This is achievable via search engine dorks (e.g., inurl:wp-content/plugins/ameliabooking), plugin version fingerprinting through readme files or asset URLs, or by scanning for the plugin's distinctive REST API endpoints or booking form markers.

Step 2 — Flaw Trigger: The attacker submits a booking request directly to the AddBookingCommand endpoint without any nonce or authentication token. Because nonce verification is skipped at line 186 of Command.php, the request is processed and creates a new appointment.

Step 3 — Payload/Execution Method: In the booking submission, the attacker sets the customer firstName or lastName field to a malicious value. Since sanitize_text_field() preserves double quotes, the payload can take a form structurally similar to: " onmouseover="alert(document.cookie)". This value, when stored, contains raw double quotes that break out of the title attribute context when rendered by the FullCalendar eventContent callback. The injected onmouseover event handler is attached to the rendered appointment element and will execute JavaScript when the administrator hovers over it.

Step 4 — Post-Exploitation Impact: When an administrator with calendar access hovers over the malicious appointment, the injected script executes in the administrative context. Practical outcomes include session cookie theft (enabling full admin session hijack), forced credential phishing overlays, creation of rogue administrative WordPress accounts, or modification/deletion of booking data and other site content. The attacker can pivot from a single XSS to complete WordPress site compromise.

Note: No public PoC or exploit code is currently available; this attack chain is inferred from the NVD description and the explicitly cited vulnerability class (stored XSS with attribute breakout via unescaped double quotes).

Impact Assessment

Business Impact: A successful exploit results in stored XSS that executes solely in the administrator's browser context. This targets the most privileged user class on the WordPress installation. Real-world impacts include:

• Session Hijacking: Exfiltration of administrator session cookies enables account takeover and lateral movement within the WordPress admin panel.
• Data Integrity: The attacker can modify or delete appointments, customer records, and potentially other plugin data.
• Site Compromise: Chained with WordPress admin access, the attacker can upload plugins/themes containing backdoors, modify site content, install crypto-miners, or use the compromised site as a distribution vector for further malware.

CVSS Rationale (7.2 High): The score reflects AV:N/AC:L (network-exposed, low complexity), PR:N/UI:N (no authentication, no user interaction required for the injection itself), and S:C (scope change — the vulnerable component is the plugin, but impact extends to the broader WordPress environment). The C:L/I:L/A:N subscores acknowledge limited direct confidentiality/integrity impact; however, in practice, a stored admin-context XSS frequently cascades into full site takeover.

Affected Systems: All WordPress installations running Amelia plugin ≤ 2.2. The Calendar view is the primary trigger surface, meaning the attack requires at least one user with administrative access to view the calendar.

Blast Radius: The compromise extends beyond the plugin to the entire WordPress instance and any connected services (e.g., external databases, payment gateways, integrated CRM systems), depending on the exposed admin session's permissions.

Detection Guidance

Sigma Rule

title: Amelia Plugin Stored XSS via Booking Customer Name Fields
id: 2f6e9a1c-3f5d-4b2e-9a7c-5f1d8e4b6c3a
status: experimental
description: Detects unauthenticated booking submissions with suspicious customer name payloads targeting Amelia plugin for WordPress (CVE-2026-6286).
logsource:
  category: webserver
  product: apache
  definition: Web server access logs for WordPress sites running Amelia plugin.
detection:
  selection_booking:
    cs-method: POST
    cs-uri-query|contains:
      - 'amelia'
  selection_payload:
    cs-uri-query|contains:
      - 'firstName='
      - 'lastName='
  selection_suspicious:
    cs-uri-query|contains:
      - '%22'
      - 'onmouseover'
      - 'onerror'
      - '<script'
      - 'alert('
  condition: selection_booking and selection_payload and selection_suspicious
falsepositives:
  - Legitimate users with unusual names containing quotes
  - Automated booking integrations
level: high
tags:
  - attack.t1190
  - attack.t1059.007
  - cve.2026.6286

YARA Rule

rule CVE_2026_6286_Amelia_Stored_XSS_Payload
{
    meta:
        author = "Valters IT Security"
        description = "Detects XSS payloads targeting the Amelia WordPress plugin booking field injection"
        date = "2026-01-01"
        reference = "CVE-2026-6286"
        severity = "high"
    strings:
        $s1 = "onmouseover=" ascii wide
        $s2 = "firstName" ascii wide
        $s3 = "lastName" ascii wide
        $s4 = "add-booking" ascii wide
        $s5 = "amelia" ascii wide
        $s6 = "document.cookie" ascii wide
    condition:
        any of ($s1, $s6) and any of ($s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-6286 - Amelia WordPress Plugin Stored XSS via Booking Customer Name";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:"amelia";
    http.client_body;
    pcre:"/(firstName|lastName)=[^&]*(%22|\\x22|onmouseover|onerror|document\.cookie)/i";
    classtype:web-application-attack;
    sid:20266286;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-6286;
)

Elastic Detection

sequence by source.ip with maxspan=15m
  [ network where event.category == "network" and
    destination.port == 443 and
    network.protocol == "http" and
    http.request.method == "POST" and
    url.path contains "amelia" ]
  [ network where event.category == "network" and
    http.request.body.content contains "firstName=" and
    (http.request.body.content contains "onmouseover" or
     http.request.body.content contains "document.cookie" or
     http.request.body.content contains "%22") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "%amelia%"
| rex field=_raw "firstName=(?<first_name>[^&\"]+)"
| rex field=_raw "lastName=(?<last_name>[^&\"]+)"
| search first_name="*onmouseover*" OR first_name="*document.cookie*" OR first_name="*%22*" OR last_name="*onmouseover*" OR last_name="*document.cookie*" OR last_name="*%22*" 
| table _time, src_ip, uri_path, first_name, last_name, status
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,web_attack,cve_2026_6286,">
  <rule id="756619" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*amelia\.*</field>
    <field name="method">POST</field>
    <regex>firstName=.*(%22|\\x22|onmouseover|onerror)</regex>
    <regex>lastName=.*(%22|\\x22|onmouseover|onerror)</regex>
    <description>CVE-2026-6286: Amelia WordPress plugin - Stored XSS via booking customer name fields</description>
    <group>web_application_attack,wordpress,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The NVD references a patch, but it has not been independently confirmed. There is a single source claiming a fix, and the specific patched version is not disclosed in available intelligence data.

Immediate Mitigations (No Patch/Workaround Available from Vendor):

1. Restrict Booking Endpoint Access: Deploy a Web Application Firewall (WAF) rule to block or challenge POST requests to the Amelia booking endpoint that contain double-quote characters (" or %22) in firstName or lastName parameters.
2. Disable Booking Functionality Temporarily: If the plugin is not business-critical, deactivate the Amelia plugin until a patched version is verified and installed.
3. Monitor Admin Calendar Access: Temporarily restrict who holds "manage_options" (admin) capability. Limit calendar access to trusted administrators only.
4. Audit Existing Booking Records: Review the database for existing appointments with suspicious customer names containing HTML attributes or event handlers. Delete or sanitize any matches.

Patch/Upgrade Steps:

1. Check for an updated Amelia plugin version (≥ 2.2.1 or later). Contact the vendor or monitor the official WordPress plugin repository changelog.
2. Before upgrading, back up the WordPress database and the plugin directory.
3. Install the update, then verify that the Command.php no longer skips nonce verification and that redesign/dist/index.js performs proper HTML entity encoding on customer names in the Calendar event content callback.
4. Independently verify the patch by testing a booking submission with a payload containing double quotes and confirming it renders as inert text in the Calendar view.
5. If no patched version is released, consider replacing the plugin with an actively maintained alternative.

Long-Term Hardening:

1. Input/Output Encoding Policy: Apply context-appropriate encoding (htmlspecialchars() with ENT_QUOTES) at the point of HTML rendering, in addition to sanitization at input time. On the admin side, never render user-supplied data into innerHTML without encoding; use textContent or DOM APIs that do not interpret markup.
2. CSRF Defense: Enforce nonce verification on all state-changing endpoints, including AddBookingCommand. Nonce validation should never be skipped for public-facing write operations exposed to unauthenticated users.
3. WordPress Hardening: Apply the principle of least privilege — restrict plugin/theme editing to a minimal set of users, enforce strong admin passwords, and enable Multi-Factor Authentication (MFA) for all administrator accounts.
4. Layer Monitoring: Deploy the Sigma/Suricata/Elastic/Wazuh rules above to your detection stack, with alerting on administrative session anomalies following booking submissions.
5. Vulnerability Management: Subscribe to vendor security notifications and conduct periodic plugin version audits. Consider automated plugin update workflows with staging validation.

References

1. NVD Entry for CVE-2026-6286: https://nvd.nist.gov/vuln/detail/CVE-2026-6286
2. WordPress Plugin Repository — Amelia: https://wordpress.org/plugins/ameliabooking/ (check changelog for patched version)
3. OWASP Stored XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html (relevant to output encoding requirements)
4. CWE-79 — Cross-site Scripting: https://cwe.mitre.org/data/definitions/79.html
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-6286 is NOT listed as of writing)

Threat Actor Activity / Exploit-in-the-Wild Evidence: No public exploit code, PoC, or documented in-the-wild exploitation has been observed for CVE-2026-6286 as of the time of writing. The vulnerability is rated High (7.2) and is trivially exploitable by unauthenticated attackers on exposed WordPress installations; enterprise defenders should treat this as a priority patching item despite the absence of public PoC, as the attack class (stored XSS with admin-triggered execution) is commonly weaponized shortly after disclosure.