Simply Schedule Appointments before version 1.6.12.4 suffers from a stored Cross-Site Scripting vulnerability (CWE-79) caused by improper sanitization ordering. The plugin applies the wp_kses_post() filter too early, allowing a double-encoded payload to survive intake and be decoded into executable HTML at render time. This enables unauthenticated attackers to inject persistent malicious scripts into notifications, which execute in the context of users viewing them.

An unauthenticated attacker can inject stored malicious scripts that execute in the browsers of users viewing the affected notifications. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed starting from version 1.6.12.4 by correcting the sanitization order with the wp_kses_post() filter. Until patching, avoid exposing notification content to untrusted users or disable the affected plugin if possible.