The vulnerability CVE-2024-47638 affects the vcita Online Booking & Scheduling Calendar plugin for WordPress (versions up to 4.4.6). It is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that could execute in the context of a victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and affects multiple security properties.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected web pages. This may lead to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS vector. However, there are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds if provided by the vendor or temporarily disabling the affected plugin to mitigate risk. Monitor official vcita communications for updates on patches or mitigations.