CVE-2026-6486

CVE-2026-6486 is a cross-site scripting (XSS) vulnerability in Classroom Bookings up to version 2.17.0, affecting the User Display Name Handler function within the layout.php file. The vulnerability exists in the displayname parameter and allows remote attackers to inject malicious scripts through user display names. The vendor has released a patch in version 2.17.1 (commit 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a) and responded professionally to early disclosure. The vulnerability carries a CVSS 3.5 LOW severity rating with network-based attack vector and low attack complexity, though it requires user interaction and valid credentials. The impact is limited to integrity violations with no confidentiality or availability impact. The EPSS score of 0.00033 indicates minimal exploitation probability in the wild compared to other CVEs. Exploitation status shows the vulnerability is currently on the active Hot List with public exploit availability, though the extremely low EPSS score suggests minimal real-world exploitation activity. There is no indication of active widespread exploitation or inclusion in known exploitation databases at this time. Immediate patching to version 2.17.1 is recommended, particularly for systems with internet-facing deployment or handling sensitive classroom data.