Simply Schedule Appointments stores message content for booking notifications without properly filtering HTML after it has been decoded twice. This double‑encoding flaw allows a malicious payload to survive the sanitization routine and be rendered as executable JavaScript when a user opens the notification. The resulting stored cross‑site scripting (CWE‑79) can lead to arbitrary script execution in the browser context of anyone who views the notification, potentially exposing session data, defacing the interface, or facilitating credential theft.

WordPress sites that use the Simply Schedule Appointments plugin version 1.6.12.2 or earlier. The plugin is widely installed on public or private booking portals hosted on WordPress, where customer information is entered without proper sanitization.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is unauthenticated and requires only that an attacker creates a booking entry containing a double‑encoded XSS payload; any subsequent visitor who views the stored notification will be affected. Consequently, any site visitor can trigger script execution by accessing a page rendering the notification.