Threats tagged 'ghsa-ffw8-2wfv-h8fc'

The Appointment Booking Plugin for WordPress versions before 5.7.6 contains a vulnerability where several booking-form step content settings are not properly escaped before rendering on the public booking form. This allows high-privilege users, such as administrators, to inject JavaScript that executes in the browsers of visitors who load the form. In multisite environments, this vulnerability crosses a privilege boundary to unauthenticated visitors when administrators lack the unfiltered_html capability.