The Smart Appointment & Booking plugin for WordPress is vulnerable to stored cross‑site scripting caused by inadequate sanitization and escape of data posted through the saab_save_form_data AJAX action. Authenticated users with Subscriber‑level access and above can inject arbitrary JavaScript into the plugin’s data store. When a page that references the stored data is subsequently viewed, the injected script executes in the victim’s browser, enabling the attacker to steal session cookies, deface content, or perform other client‑side attacks. This weakness is identified as CWE‑79 and affects confidentiality, integrity, and potentially availability of the site’s content for all users who view the affected pages.

It impacts the WordPress plugin Smart Appointment & Booking from ZealOpenSource. All versions up to and including 1.0.7 are affected; versions 1.0.8 and above are not impacted.

The bug carries a CVSS score of 6.4 (medium). The EPSS score is below 1 %, indicating a very low exploitation probability at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authentication with a role of Subscriber or higher, but once the malicious script is stored it can affect any site visitor who loads the injected content. The attack vector is the authenticated AJAX request to saab_save_form_data, and the impact is the execution of arbitrary client‑side code.