Executive brief
The QuickCal appointment booking plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into pages without authentication. When site visitors access a page with an infected booking calendar, the injected scripts execute in their browsers, potentially stealing credentials, session tokens, or sensitive information. The vulnerability is especially dangerous because the nonce (security token) needed to exploit it is publicly visible in the page source, making attacks trivial to carry out.
Technical details
The QuickCal plugin fails to properly sanitize and escape user input in custom field parameters passed to the unauthenticated booked_add_appt AJAX action. An attacker can craft malicious input containing JavaScript code that is stored and later executed when any user views the affected booking calendar shortcode. The nonce protecting this AJAX action is embedded directly in the HTML of any page rendering the calendar, making it publicly obtainable and removing the need for prior authentication or account access. The vulnerability allows arbitrary script injection and execution in the context of legitimate site pages, enabling account hijacking, credential theft, or malware distribution. Patches should be available in versions after 1.0.20.
Affected products
- QuickCal QuickCal up to and including 1.0.20
Timeline
- 2026-09-05: disclosed