Threats tagged 'ghsa-fpgw-376p-gw9c'

The Appointment Booking Calendar plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'vs_text_submitbtn' parameter affecting all versions up to and including 1.4.05. This flaw allows authenticated users with subscriber-level access or higher, if assigned as calendar owners by an administrator, to inject malicious scripts that execute when other users view the affected pages. By default, exploitation requires editor-level access or above, but administrators can grant calendar ownership to subscribers, lowering the exploitation threshold.