Input validation vulnerability in Booking Calendar 9.7.4

The Booking Calendar plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting. This kind of attack is possible because the plugin does not properly check and protect user-supplied data when it is used in pages. Attackers who are signed in with contributor-level or higher permissions can take advantage of this vulnerability to inject malicious web scripts into pages that will execute when a user visits the page. This affects versions up to and including 9.7.3.3.