The vulnerability is an improper neutralization of script‑related HTML tags, allowing a user to inject JavaScript code into pages rendered by the Easy Appointments plugin. This basic XSS flaw could be used to perform session hijacking, defacement, or phishing attacks against site visitors. The impact remains within the web interface of the plugin and does not provide direct remote code execution on the server, but any successful payload execution grants the attacker what the user can do in the compromised browser context.

WordPress Easy Appointments plugin versions up to and including 3.12.14 are affected. The vulnerability exists in all releases prior to 3.12.15, so any WordPress site running the plugin on those versions is at risk. No other WordPress plugins or core components are listed as affected.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. Because the flaw is an XSS, an attacker typically needs a user to visit a page that incorporates the injected content, which may limit amateur attacker feasibility. The vulnerability is not listed in the CISA KEV catalog.