Input validation vulnerability in gAppointments – Appointment booking addon for Gravity Forms 1.9.5.1

The gAppointments – Appointment booking addon for Gravity Forms plugin for WordPress is vulnerable to a security issue called Stored Cross-Site Scripting. This means that an attacker, who has administrator-level access, could inject malicious code into web pages of a WordPress site. This code would then run whenever a user visits the injected page. This issue only affects multi-site installations or installations where a certain security feature has been disabled. All versions of the plugin up to and including 1.9.5.1 are affected.