Administrator-context script execution via unescaped staff name

Stored XSS in Bookly before 20.3.1 allows remote authenticated users to execute scripts in an administrator's browser. The plugin stores a Staff user's Full Name and renders it without output escaping on the Staff Members order page. A Staff Member account is required to plant the payload, and an administrator must open that page, where the script runs in the administrator's browser context.