The vulnerability is a reflected Cross‑Site Scripting (XSS) flaw that occurs when the plugin fails to neutralize user‑supplied input before including it in the rendered web page. An attacker can deliver malicious JavaScript through crafted query parameters or form inputs, which is then executed in the victim’s browser. This can lead to client‑side defacement, theft of session cookies, or the execution of further attacks against that user, potentially compromising confidentiality and integrity of user accounts within the WordPress site.

SwiftCloud Swift Calendar Online Appointment Scheduling, a WordPress plugin, is the affected product. Versions up to and including 1.3.3 are vulnerable. No other affected versions were disclosed.

The CVSS score of 7.1 indicates a high‑severity issue. The EPSS score of less than 1% suggests exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through the web interface; an attacker can craft a malicious URL or input that is reflected back to the victim. Because it is a reflected XSS, exploitation requires victim interaction, such as clicking a compromised link, but the vulnerability can still be leveraged in social‑engineering or phishing campaigns.