Zackary Loevseth

**Name of the Vulnerable Software and Affected Versions** Appointment Hour Booking – Booking Calendar plugin for WordPress versions prior to 1.5.98 **Description** Insufficient input sanitization and output escaping in the Schedule Calendar List Renderer allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the Booking Form Single-Line Field, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. This issue is exploitable only if the `list readmore numberofwords` parameter is configured with a positive integer value, as the default value of 0 bypasses the vulnerable code path. **Recommendations** Update the plugin to a version newer than 1.5.97. Set the `list readmore numberofwords` parameter to 0 to mitigate the risk of exploitation.