An unauthenticated stored cross-site scripting vulnerability in the vcita Online Booking & Scheduling Calendar plugin allows attackers to inject malicious scripts into the WordPress site.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) caused by insufficient input validation of the business_id parameter. The vulnerability is exploitable by unauthenticated users, allowing for the injection of arbitrary web scripts that execute in the context of a victim's browser.

Exploitation of this vulnerability allows an attacker to execute malicious scripts in the browsers of site visitors or administrators. This can lead to session hijacking, credential theft, or the redirection of users to malicious sites, significantly impacting site reputation and user security. With a CVSS score of 7.2, this is a serious threat to any WordPress site utilizing this plugin.

Immediate Action: As there is no patched version currently available, deactivate and remove the plugin until a security update is released by the vendor.

Proactive Monitoring: Monitor web server logs for suspicious URL requests containing injected script content in the business_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to block malicious payloads targeting the affected parameter.

Public Exploit Available: Unknown

Given the lack of a patched version, the safest course of action is to deactivate the plugin immediately. Continue to monitor the vendor release notes for version 4.6.1 or higher to resolve the vulnerability.