Hieus

An issue exists where the plugin fails to perform a capability check within an appointment-deletion function. This allows users assigned to the low-privileged custom Staff role to delete arbitrary appointments.

Insufficient file path validation in the `delete submission files()` function allows unauthenticated attackers to delete arbitrary files on the server. This is achieved by submitting a malicious path traversal URL via a form upload field, which is then stored in the database. The deletion is triggered when an administrator removes the submission record from the admin panel. Deleting critical files, such as `wp-config.php`, can lead to remote code execution.

The plugin fails to properly escape a user-supplied URL before outputting it within an HTML attribute. This allows unauthenticated users to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, which then execute in the browser of any user, including administrators, who views the affected content.