The Appointment Booking Calendar plugin for WordPress is vulnerable to stored cross‑site scripting via the vs_text_submitbtn parameter. Insufficient input sanitization and output escaping allow an authenticated user with subscriber‑level access or higher to inject arbitrary web scripts into pages that will execute whenever a user accesses an affected page. The flaw requires the attacker to be assigned as the calendar owner, a per‑user grant that administrators can extend to subscriber accounts.

All WordPress sites running the Appointment Booking Calendar plugin version 1.4.05 or earlier are affected. The plugin is developed by codepeople and is a widely used calendar solution in WordPress environments. Users who have been granted calendar owner rights – including subscriber accounts that have been assigned ownership by an administrator – are susceptible, as any subscriber account can be made an owner through the plugin’s calendar list screen.

The CVSS score of 6.4 indicates medium severity. No EPSS data is available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated attacker who has been granted ownership of a calendar; an administrator or editor must assign the attacker’s user account as owner via the plugin’s calendar list screen. Because the attack surface depends on such an assignment, the potential impact is limited to sites where subscriber accounts have been granted calendar owner privileges, but a successful exploit would allow arbitrary script execution for any user who views the affected page.