The Appointment Hour Booking – Booking Calendar plugin contains a stored cross‑site scripting flaw that allows authenticated administrators to inject arbitrary JavaScript by setting the 'Min length/characters' and 'Max length/characters' options. The injected script is stored and executed each time any user opens the form builder interface. No other privilege escalation is required beyond administrator access, and the vulnerability is only present when the WordPress unfiltered_html capability is disabled on a multi‑site installation.

WordPress sites running Appointment Hour Booking – Booking Calendar version 1.5.60 or earlier, including installations that use an unfiltered_html setting restricted to trusted users and are configured as multi‑site networks. The plugin must be present on a network where administrators can modify form field settings.

The issue scores a CVSS of 4.4 and has an EPSS probability of less than 1 %. It is not cataloged in the CISA KEV list. Exploitation requires an attacker to be logged in as an administrator or higher and to modify form field settings. Once injected, the script will run on any user who accesses the form builder, affecting all users who load that interface.