A stored cross‑site scripting vulnerability exists in NSquared Simply Schedule Appointments plugin up to and including version 1.6.12.35. Attackers can inject arbitrary script code that is rendered as part of a web page viewed by other users, enabling session hijacking, credential theft, phishing, or page defacement. The weakness is classified as CWE‑79, reflecting improper neutralization of input during web page generation.

The vulnerability impacts the WordPress plugin NSquared Simply Schedule Appointments for all sites that have not upgraded beyond version 1.6.12.35; the affected range is noted as n/a through 1.6.12.35. Administrators should assess all installations of this plugin version across their environments.

The CVSS score of 7.1 indicates a medium‑to‑high risk. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. Attackers likely exploit the flaw by adding malicious content to appointment data stored by the plugin, which is later displayed without proper escaping to any user who views that data. No specific environmental prerequisites are stated in the CVE description.