Input validation vulnerability in WP BASE Booking of Appointments, Services and Events 4.9.1

The WP BASE Booking of Appointments, Services and Events plugin for WordPress has a security issue where attackers can inject harmful web scripts through a parameter called ‘status’. This can happen on any version up to and including 4.9.1 due to lack of proper protection against malicious input. If a user falls for a trick and clicks on a link, the scripts can be executed, giving the attacker access to sensitive information.