The vulnerability allows an attacker to store malicious JavaScript in the booking customer name fields of the Amelia WordPress plugin via an authentication bypass that skips nonce verification. Even though the plugin sanitizes the firstName and lastName fields, the sanitization strips only HTML tags, leaving double quotes intact. These unsanitized strings are later rendered directly into JavaScript template literals used by FullCalendar and inserted into the page via innerHTML. An attacker can therefore inject a payload such as "" onmouseover="alert(document.cookie)" to break out of the title attribute and cause arbitrary code execution whenever an administrator views the Calendar page and hovers over the malicious appointment. The result is a stored XSS that can compromise the administrator’s session, exfiltrate cookies, or perform additional malicious actions.

Affected systems The flaw exists in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress in all released versions up to and including 2.2. Any WordPress installation that uses this plugin and has not upgraded beyond 2.2 is vulnerable. The attacker does not need any authentication; the exploit is performed entirely through the public booking interface.

Risk and exploitability The CVSS score of 7.2 indicates a high severity when combined with the potentially remote exploitation vector. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying that no active exploits have been confirmed in the public domain yet. Nevertheless, the ability for unauthenticated users to inject scripts that run in the context of the site administrator represents a serious threat. The attack requires only a crafted booking submission and is activated by the administrator’s visit to the Calendar page, making it both simple to execute and damaging.