The gAppointments plugin contains an improper neutralization of user input during web page generation, allowing an attacker to inject malicious JavaScript that is reflected back in the rendered page. This reflected XSS flaw permits arbitrary script execution when a crafted request is delivered to users, potentially enabling defacement, cookie theft, or malicious data exfiltration. The weakness is a classic input‑validation issue cataloged as CWE‑79.

WordPress sites that use the wpcrunch gAppointments plugin of any version through 1.14.1 are affected. No specific sub‑versions are listed, so all releases up to and including 1.14.1 should be considered vulnerable.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low overall exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would most likely exploit this flaw by crafting a malicious URL or input that the plugin reflects in a page served to unsuspecting users. Because it is reflected XSS, the attack does not require privileged access and can be performed remotely via a web browser.