The vulnerability is a classic input validation flaw that allows an attacker to inject arbitrary script code into the appointment booking interface, which is reflected or stored and then executed in the victim’s browser. This can lead to cookie theft, session hijacking, defacement or delivery of additional malware. The weakness is identified as CWE-79, a classic reflected or stored cross-site scripting flaw that compromises confidentiality, integrity, and availability of the web application user experience.

Any WordPress site that has installed the Appointment Hour Booking plugin version 1.5.86 or earlier. The plugin is published by codepeople and integrates into the WordPress admin backend, allowing users to configure booking options and view booking data. No other product versions are known to be impacted at the time of this advisory.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests this flaw is currently unlikely to be actively exploited in the wild. It is not listed in the CISA KEV catalog, further indicating low current exploitation risk. The attack vector is inferred to be via the web interface—specifically the admin pages that accept user input for booking configuration—because the flaw arises from unsanitized input in the plugin’s code.