Easy!Appointments allows an administrator to enter arbitrary HTML or JavaScript into the booking-disabled message field using a rich-text editor. The content is stored in the disable_booking_message setting and later rendered on the public booking page without escaping or sanitization, creating a stored cross‑site scripting vulnerability (CWE-79). An attacker who can become an authenticated administrator can inject malicious code that will execute in the browsers of any unauthenticated visitor who opens the booking page.

Installations of the Easy!Appointments appointment scheduler from the vendor alextselegidis, running any version earlier than 1.6.0, are affected. The latest release 1.6.0 includes the fix for this gap.

The CVSS score of 2.6 reflects low overall severity because exploitation requires administrative credentials; it is not a publicly exploitable vulnerability. The EPSS score remains below 1%, indicating a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, once an administrator injects malicious content, every visitor to the public booking page is exposed, making it a persistent threat within the affected environment.