The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.Referenceshttps://wordpress.org/plugins/booking-calendar-contact-form/#developers