Unauthenticated shortcode execution via unsanitized locale

Code injection in N Squared Digital Simply Schedule Appointments 1.6.8.5 and earlier allows remote attackers to execute arbitrary shortcodes. The appointments REST endpoint accepts customer_locale from unauthenticated booking requests; page-appointment-edit.php concatenates the stored value into an ssa_booking string and passes it to do_shortcode without validating shortcode syntax. An attacker must create an appointment, and the payload executes when the appointment edit page is rendered, allowing site-dependent shortcode actions or stored script execution in the viewing session.