Online Booking & Scheduling Calendar for WordPress by Vcita

A stored cross-site scripting (XSS) vulnerability in the vcita WordPress plugin up to version 4.6.0 allows unauthenticated attackers to inject arbitrary scripts via the 'business_id' parameter.