Starboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

*   `preg_match('/["\'\;<>\\{}]/', $value)` blocks `<` and `>`.
*   The sanitization seems solid *if used*.

*   Let's look at the most likely scenario: The developer uses `shortcode_atts` to get a list of values, and then iterates over that list to build the `data-` attributes for the lightbox JS.
*   In `starboard-suite.php`:
    ```php
    $data_attributes = array(
       ...
    );
    ```
*   If there's an attribute in `$atts` (from `shortcode_atts`) that is NOT put into `$data_attributes` but instead appended to the `$output` string directly.
*   Or, if `$data_attributes` is simply used to build the string like this:
    ```php
    foreach ($data_attributes as $key => $val) {
        $output .= " data-$key='$val'";
    }
    ```
*   And if one of the attributes was *added* to `$data_attributes` but *missed* the `sanitize_` call.
*   Example:
    `'gift-certificate' => $atts['gift-certificate'],` (missing sanitize call)
*   Then `[starboard-suite-lightbox gift-certificate="' onmouseover='alert(1)'"]` would work.