The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to stored Cross‑Site Scripting because the ‘after’ parameter is not properly sanitized or escaped. An authenticated attacker with Contributor access can inject arbitrary JavaScript that will execute whenever any user views a page containing the injected content, allowing for actions such as cookie theft, session hijacking, or phishing attacks. The flaw is limited to Chromium‑based browsers such as Chrome, Edge, and Brave, but once injected it persists in the stored content and can impact every user that later views the affected page.

All installations of the SuperSaaS – online appointment scheduling WordPress plugin in releases up to and including version 2.1.12 are affected. Any site running those versions and granting Contributor or higher privileges can be used to inject malicious scripts via the vulnerable parameter.

With a CVSS base score of 4.9 the flaw is considered moderate severity. The EPSS score of less than 1% signals a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, and the required conditions of authenticated Contributor privileges and usage of a Chromium browser reduce the attack surface. Nevertheless, the persistent nature of the stored XSS means that any user who later views the content can be compromised.