[LOW] Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

PKSA-qjn8-scvh-tqz1 CVE-2026-52838 GHSA-996f-334j-67g7

Affected package: alextselegidis/easyappointments

Affected version: <=1.5.2

Reported by:
GitHub