The vulnerability arises because the Booking Form Step Settings in the Appointment Booking Plugin are rendered without proper escaping, allowing an administrator or similarly privileged user to insert malicious JavaScript that runs in any visitor’s browser when the form is viewed. This is a classic stored cross‑site scripting flaw that can lead to session hijacking, credential theft, or other client‑side attacks, and, on multisite installations, can breach a privilege boundary to reach unauthenticated users. The weakness resides in inadequate input validation and lack of output encoding, a common category of scripting vulnerabilities.

All installations of the Appointment Booking Plugin for WordPress with a version earlier than 5.7.6 are affected. Administrators of these sites can exploit the flaw by configuring booking‑form step content that includes unescaped JavaScript. The issue is particularly severe on multisite networks where administrators do not possess the unfiltered_html capability, enabling cross‑user privilege escalation to unauthenticated visitors.

The CVSS base score is not provided, but given the ability for high‑privilege users to inject arbitrary script that affects all form viewers, the risk is high. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the attack vector is local administrator‑based and can be triggered by any user with editing rights to booking‑form step settings. A capable attacker can compromise the user experience for visitors, capture credentials, or redirect to malicious sites. Because no network‑level checks are required, the exploitability is straightforward once the proper privileges are obtained.