Executive brief
The vcita Online Booking & Scheduling Calendar WordPress plugin allows attackers to inject and store malicious code that executes when users view affected pages, potentially compromising visitor accounts or stealing sensitive data. An unauthenticated attacker can exploit insufficient input validation on the business_id parameter to carry out this attack. This vulnerability affects all versions up to 4.6.0 and poses a significant risk to websites using this booking system.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the vcita Online Booking & Scheduling Calendar plugin caused by insufficient input sanitization and output escaping of the 'business_id' parameter. The vulnerable code path processes user-supplied input without proper validation or encoding before storing it in the database and rendering it in pages. An unauthenticated attacker can inject arbitrary JavaScript via the business_id parameter, which will be persistently stored and executed in the browsers of all users who visit the affected page. This allows attackers to steal session cookies, perform actions on behalf of users, or redirect visitors to malicious sites. The vulnerability is present in versions up to and including 4.6.0.
Affected products
- vcita Online Booking & Scheduling Calendar up to and including 4.6.0
Timeline
- 2026-08-15: disclosed