This vulnerability (CVE-2024-35761) involves improper neutralization of input in the vCita Online Booking & Scheduling Calendar for WordPress, resulting in stored cross-site scripting (CWE-79). The flaw allows attackers with at least low privileges and user interaction to inject malicious scripts that execute in the security context of the affected application. The issue affects all versions up to 4.4.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The impact is rated medium severity with limited but non-negligible consequences. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting privileges of users who can input data into the affected plugin and monitor for suspicious activity. Avoid relying on generic mitigations that are not specific to this vulnerability. No official vendor mitigation or temporary fix has been published.