CVE-2026-57858 - Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID
Brief
CVE ID : CVE-2026-57858
Published : Aug. 12, 2026, 12:23 p. m.
- 41 minutes ago
Description : Cal. com Cal. diy versions 2.
- 1 through 6.
- 0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization.
Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.
Severity: 9.3
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...