Unauthenticated Cross Site Scripting (XSS) exists in the NSquared Simply Schedule Appointments WordPress plugin for versions 1.6.12.2 and earlier. The flaw is identified as CWE‑79 and allows an attacker to inject arbitrary client‑side script through vulnerable input fields. If successfully exploited, the attacker could steal user cookies, hijack sessions, deface site content, or redirect users to malicious sites, thereby compromising data confidentiality, integrity, and potentially the availability of user‑generated content.

The vulnerability affects the NSquared Simply Schedule Appointments plugin for WordPress, specifically any installation running version 1.6.12.2 or older. Upgrading to version 1.6.12.4 or newer removes the affected code paths.

The CVSS score of 7.1 indicates a high impact when exploitation is possible, but the EPSS score is not available, so the real-world probability of exploitation cannot be quantified from current data. The vulnerability is not listed in the CISA KEV catalog. Because the attack does not require authentication and can be triggered from the public web interface, the primary attack vector is through unauthenticated HTTP requests containing malicious payloads targeting the vulnerable fields. No additional exploitation conditions are documented.