A Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin. This vulnerability allows an attacker to inject malicious scripts into the affected website, potentially compromising the security of the website and its visitors.

This significant security flaw was uncovered and responsibly reported by LEE SE HYOUNG (hackintoanetwork), signifying a critical vulnerability that demands immediate attention.

The vulnerability is a Cross-Site Scripting (XSS) vulnerability that occurs in the vcita-booking-calendar.php file. The vulnerability allows an attacker to inject malicious scripts into the affected website by specifying a specially crafted URL in the vcita_calendar_id parameter of the get_calendar function.

Severity:

The vulnerability has a CVSS 3.1 score of 7.1, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

The vulnerability affects WordPress websites that use the Online Booking & Scheduling Calendar for WordPress by vcita Plugin prior to version 4.3.3.

Impact:

An attacker who successfully exploits this vulnerability could inject malicious scripts into the affected website, such as:

  • Phishing scripts
  • Malware
  • Ads

This malicious code could then be executed by visitors to the website, potentially leading to a variety of security risks, such as:

  • Stealing personal information
  • Damaging the website’s files or database
  • Taking control of the website

Recommendation:

Swift and effective action is paramount to secure the website and user data:

  • Update Immediately: Ensure the immediate update of the Online Booking & Scheduling Calendar for WordPress by vcita Plugin to at least version 4.3.3. This update includes critical fixes to address the Cross Site Scripting (XSS) vulnerability and elevate the overall plugin security.
  • Regular Security Practices: Embrace routine security practices such as periodic security audits to detect and address vulnerabilities proactively. Consistent updates and maintenance contribute to a robust security posture.
  • Stay Informed: Stay informed about updates and advisories concerning the Online Booking & Scheduling Calendar for WordPress by vcita Plugin. Timely updates and heightened awareness are key to maintaining the website’s security.

This vulnerability is a serious threat to the security of WordPress websites that use the Online Booking & Scheduling Calendar for WordPress by vcita Plugin. Users are advised to update to version 4.3.3 or higher as soon as possible.