This vulnerability in the Appointment Buddy Widget by accreteinfosolution involves improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). It affects versions up to and including 1.2. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The impact scope is changed (scope: changed), with low confidentiality and integrity impact, and low availability impact. No patch or vendor advisory is provided to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 reflects a high severity risk, but no known exploits have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider applying input validation or output encoding controls at the application or web server level to mitigate XSS risks. Monitor vendor channels for updates.