Stored XSS in Online Booking & Scheduling Calendar for WordPress by vcita

The 'Online Booking & Scheduling Calendar for WordPress by vcita' plugin is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 4.6.0 (CVE-2026-14433). The vulnerability arises from insufficient input sanitization and output escaping on the 'business_id' parameter. This flaw allows an unauthenticated attacker to inject malicious JavaScript into the application, which is then stored and subsequently executed in the browser of any user who views the page where the injected content is rendered. Given the plugin's role in booking and scheduling, this could be leveraged for session hijacking, unauthorized actions on behalf of site administrators, or redirecting site visitors to malicious domains.

Attack Chain

1. Attacker identifies an instance of the 'Online Booking & Scheduling Calendar for WordPress by vcita' plugin.
2. Attacker crafts an HTTP request containing a malicious JavaScript payload within the 'business_id' parameter.
3. The plugin fails to sanitize the 'business_id' input before processing or storing it.
4. The malicious payload is saved into the WordPress database.
5. A victim user (e.g., administrator or site customer) navigates to the compromised web page.
6. The web server renders the stored, unsanitized payload into the HTML response.
7. The victim's browser executes the injected JavaScript script in the context of the vulnerable site.
8. Attacker achieves execution of arbitrary code within the victim's browser session.

Impact

Successful exploitation of CVE-2026-14433 can lead to the compromise of user sessions, allowing attackers to perform unauthorized actions as the victim. If an administrator is targeted, this could lead to full site compromise, including the modification of site content, exfiltration of sensitive booking data, or redirection of traffic.

Recommendation

• Update the 'Online Booking & Scheduling Calendar for WordPress by vcita' plugin to the latest version available (patch versions beyond 4.6.0).
• Implement a Content Security Policy (CSP) to mitigate the impact of XSS attacks by restricting the execution of inline scripts and unauthorized external resources.
• Monitor web application logs for HTTP requests containing abnormal character strings (e.g., '<script>', 'javascript:', 'onerror=') within parameter values.
• Utilize a Web Application Firewall (WAF) to inspect and block malicious payloads targeting the 'business_id' parameter.