Appointment Hour Booking Booking Calendar
Monthly
Stored DOM-based cross-site scripting in the Appointment Hour Booking - Booking Calendar WordPress plugin (all versions up to and including 1.5.97) allows unauthenticated remote attackers to inject arbitrary web scripts via a Booking Form single-line field, which execute when a victim loads the affected Schedule Calendar list page. Exploitation requires the non-default 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; the default value of 0 bypasses the vulnerable decode-and-truncate branch and is not exploitable through this sink. The assessed CVSS is 7.2 with Low confidentiality and Low integrity impact, and no public exploit was identified at time of analysis; overall this is a moderate, conditional web risk rather than an urgent priority.
Stored DOM-based cross-site scripting in the Appointment Hour Booking - Booking Calendar WordPress plugin (all versions up to and including 1.5.97) allows unauthenticated remote attackers to inject arbitrary web scripts via a Booking Form single-line field, which execute when a victim loads the affected Schedule Calendar list page. Exploitation requires the non-default 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; the default value of 0 bypasses the vulnerable decode-and-truncate branch and is not exploitable through this sink. The assessed CVSS is 7.2 with Low confidentiality and Low integrity impact, and no public exploit was identified at time of analysis; overall this is a moderate, conditional web risk rather than an urgent priority.