The vulnerable WordPress plugin allows unfiltered input to be passed to the do_shortcode function, enabling an attacker to include any shortcode string that WordPress will then execute. This code injection flaw (CWE‑94) permits the injection of malicious code or content, potentially leading to cross‑site scripting or other site compromises. Because the plugin does not validate or restrict the shortcode parameters, the flaw can be exploited by any user with network access.

The issue affects the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress versions 1.6.8.5 and earlier. No other products are listed, so only installations of this plugin within those version ranges are vulnerable.

The CVSS score of 7.3 indicates a high severity, and although the EPSS score is less than 1%, it is still nonzero, showing that an attacker could craft an exploit. The vulnerability is not in CISA’s KEV catalog. Attackers would need to send a crafted HTTP request to the plugin endpoint that processes shortcodes. Because the attack requires no authentication, it can be performed by any internet‑connected user who can reach the site, enabling arbitrary shortcode execution that may lead to site compromise or malicious payload execution.