CVE-2021-24673: 
WordPress vulnerability analysis and mitigation

CVE-2021-24673 is a Stored Cross-Site Scripting vulnerability affecting the WordPress plugin Appointment Hour Booking versions prior to 1.3.16. The vulnerability was discovered by Asif Nawaz Minhas and was publicly disclosed on September 6, 2021 (WPScan).

The vulnerability exists because the plugin does not properly escape some of the Calendar Form settings, specifically in the Form Name and Description fields. This security flaw allows high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The vulnerability is classified as CWE-79 and has been assigned a CVSS score of 3.4 (low severity) (WPScan).

When successfully exploited, the XSS payload gets triggered in two scenarios: when editing the calendar again in the admin dashboard, and in posts/pages where the calendar is embedded. This could potentially lead to unauthorized script execution in the context of other users' browsers (WPScan).

The vulnerability has been fixed in version 1.3.16 of the Appointment Hour Booking plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).