The vulnerability allows an unauthenticated attacker to inject any JavaScript payload via the 'status' parameter of the "status" endpoint. Because debug logging is enabled by default, the payload is stored into the debug log without sanitization and is rendered to browsers when debug logs are viewed. An attacker controlling the injected content can then execute malicious code in the context of any user who opens the debug‑log viewer, potentially stealing cookies, tampering with page content, or defacing the site.

The problem targets the WordPress plugin Simply Schedule Appointments, versions 1.6.12.35 and earlier. Any WordPress installation running this plugin and that has debug logging enabled is vulnerable.

The CVSS score of 7.2 classifies this as a high‑severity flaw. No EPSS data is published, and it is not listed in the CISA KEV catalog. The attack path relies on the availability of the JSON endpoint, no privileged access, and the presence of a site‑wide Support PIN that grants visibility into debug logs. Once the SSS endpoint is accessed, an attacker can store arbitrary JavaScript; when a legitimate administrator or support staff opens the debug‑log viewer, the script will run in their browser. The exploit can be conducted without user interaction beyond opening the debug logs, making it attractive for attackers who can acquire or guess the Support PIN.