Description

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T07:17:10.793Z",
  "pubdate": "2026-09-05T07:17:10.793Z",
  "executiveSummary": "The QuickCal WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.0.20.\nThis flaw arises from inadequate input sanitization and output escaping mechanisms within the plugin's custom field parameters.\nThe vulnerability allows unauthenticated attackers to inject malicious JavaScript into web pages rendered by the plugin.\nThe attack vector is facilitated by the public exposure of a nonce used to protect the 'booked_add_appt' AJAX action, which can be harvested by any visitor to a page containing the booking calendar shortcode.\nSuccessful exploitation enables attackers to execute arbitrary code within the context of a victim's browser session, leading to potential account compromise, session hijacking, or unauthorized actions performed on behalf of authenticated users.\nGiven that the exploit requires no prior authentication or administrative privileges, this vulnerability poses a significant risk to site integrity and visitor security.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the QuickCal plugin to implement server-side sanitization on custom field parameters before storing them in the WordPress database, combined with a lack of proper output escaping when these fields are rendered in the front-end.\nThe 'booked_add_appt' AJAX action is designed to handle appointment booking requests. While it is protected by a WordPress nonce to prevent Cross-Site Request Forgery (CSRF), this nonce is inadvertently exposed in the HTML source code of any page where the QuickCal booking calendar shortcode is present. This exposure allows unauthenticated actors to retrieve the nonce via simple DOM inspection.\nThe exploitation flow begins with an attacker identifying a page utilizing the QuickCal shortcode to obtain the valid security nonce. Once the nonce is acquired, the attacker crafts a malicious POST request targeting the 'booked_add_appt' AJAX endpoint.\nWithin the payload of the appointment booking request, the attacker embeds malicious JavaScript payloads into the custom field parameters. Because the application processes these inputs without strict validation or sanitization, the payloads are stored directly in the database associated with the appointment record.\nUpon a victim (typically an administrator or authorized user) viewing the appointment details within the WordPress dashboard or a public-facing calendar view, the application retrieves and renders the stored, malicious content without escaping.\nThis triggers the execution of the injected script in the victim's browser environment. The impact of this execution is broad, as the script operates with the victim's session cookies and permissions. This can lead to the unauthorized modification of site settings, the creation of rogue administrator accounts, or the redirection of traffic to malicious external domains.\nThe vulnerability is present in versions 1.0.20 and older, affecting any WordPress installation where the plugin is active and the booking calendar shortcode is rendered to the public."
}