This vulnerability permits attackers to inject and run arbitrary JavaScript code in the context of a victim’s browser through the instant‑appointment plugin’s ref­lected input handling. The flaw falls under CWE‑79 and can be leveraged to hijack user sessions, steal cookies, or execute malicious scripts, thereby compromising confidentiality and availability of web application content.

The problem affects the tenteeglobal Instant Appointment WordPress plugin versions up to and including 1.2. No narrower version range is provided, so any installation of the plugin at or below 1.2 is considered susceptible.

The CVSS base score of 7.1 categorizes the issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a remote attacker crafting a malicious URL or form input that is reflected back in the generated page; no specific exploitation conditions beyond standard web interaction are reported.