Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS

Description The plugin does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators

PoC

As an unauthenticated user, submit a booking form (such form can be added via the Booking Calendar Block on a page/post) with the payload below in the First or Last Name field: "> Which is the HTML encoded of > The XSS will be triggered when an admin will access the calendar overview dashboard (ie /wp-admin/admin.php?page=wpbc&view;_days_num=90&view;_mode=vm_calendar)