Description

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-15T03:16:47.130Z",
  "pubdate": "2026-08-15T03:16:47.130Z",
  "executiveSummary": "An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability exists within the Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress in all versions up to, and including, 4.6.0. The security defect arises from insufficient input sanitization and output escaping applied to the 'business_id' parameter. This flaw allows remote, unauthenticated attackers to inject arbitrary web scripts or HTML payloads directly into application pages. When authorized users or administrators access the compromised pages, the injected scripts execute within the context of their active browser sessions, potentially leading to unauthorized actions, session hijacking, or defacement. The risk implication is significant as it requires zero authentication and targets widely utilized scheduling components, exposing web applications to persistent client-side compromise.",
  "technicalDetails": "The vulnerability stems from the improper handling of user-supplied input routed through the 'business_id' parameter within the Online Booking & Scheduling Calendar for WordPress by vcita plugin. Specifically, the application fails to perform rigorous input validation and context-aware output escaping before persisting the parameter value and rendering it back to users in subsequent HTTP responses. The vulnerable component processes the 'business_id' parameter directly, enabling threat actors to inject malicious JavaScript payloads.\nExploitation is carried out via a standard network exposure vector over HTTP/HTTPS, requiring no prior authentication or administrative privileges. An attacker crafts a malicious request containing arbitrary web scripts mapped to the 'business_id' parameter, which is then accepted and stored by the vulnerable backend functionality. Once stored, whenever a victim accesses the injected page, the malicious payload is served as part of the document object model (DOM). The payload executes automatically within the victim's browser context, leveraging their privileges.\nThe post-exploitation impact includes the execution of arbitrary script code in the victim's session, which can facilitate session hijacking, theft of sensitive authentication cookies, redirection to malicious external sites, or unauthorized execution of administrative functions depending on the privileges of the user viewing the injected page."
}