Appointment Hour Booking vulnerabilities

The Appointment Hour Booking plugin versions up to 1.5.86 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.

Broken Access Control vulnerability in Appointment Hour Booking versions up to 1.5.91. The attack does not require authentication.

The Appointment Hour Booking WordPress plugin before version 1.5.88 does not validate a client-supplied booking price against the server-side configured service price. Unauthenticated users can submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.