The Appointmind WordPress plugin exposes a stored cross‑site scripting flaw through its appointmind_calendar shortcode. The plugin fails to sanitize or escape user‑supplied attributes, allowing an attacker who can create or edit content with contributor or higher privileges to embed malicious JavaScript. When another user visits a page that includes the compromised shortcode, the attacker‑supplied script is executed in the victim’s browser, enabling the theft of session data or site defacement.

WordPress sites that have installed Appointmind plugin version 4.1.0 or earlier. The vulnerability affects all releases up to and including 4.1.0 and impacts any site using the appointmind_calendar shortcode through any contributor‑level role.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1 % implies that exploitation is currently unlikely and the flaw is not listed in CISA’s KEV catalog. Attackers must be authenticated with at least contributor level, so the vulnerability is an authenticated stored XSS that can be triggered by injecting script into the shortcode, after which the payload runs for any user who views the affected page, threatening user confidentiality and site integrity.