The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross‑Site Scripting through custom booking field labels. The flaw arises from insufficient input sanitization and output escaping, allowing an authenticated attacker with Author-level access or higher to inject arbitrary JavaScript into the booking pages. When other users view the injected page, the malicious code executes in their browser, potentially compromising session data, defacing content, or performing other client‑side attacks.

All releases of Creavi Appointment Booking Calendar up to version 1.4.4 installed on WordPress sites are affected. The plugin can be found under the Creavi vendor product name.

The CVSS base score of 6.4 indicates medium severity. The exploit requires the attacker to have Author or higher permissions to edit booking field labels, which is not normally available to anonymous users. EPSS is not reported, and the vulnerability is not listed in KEV at this time. The attack vector is authenticated, and the stored nature of the flaw means that once injected, the malicious script will affect every subsequent visitor to the page until remedied.