Summary

The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS

3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Details

The “Translations” settings of the plugin are vulnerable to XSS using the payload: "/><img src=x onerror=alert(/XSS/)> Entering it for any value and reloading the page will result in the XSS.