The Online Booking & Scheduling Calendar for WordPress by vcita plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to inadequate input validation and missing authorization on the 'wp_id' parameter in the processAction function. This allows unauthenticated attackers to inject arbitrary scripts that execute in the WordPress admin dashboard context, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 4.4.2. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation enables unauthenticated attackers to inject persistent malicious scripts that execute in the WordPress admin dashboard. This can lead to unauthorized actions such as session hijacking, data theft, or manipulation of administrative functions. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the WordPress admin dashboard to trusted users only and monitoring for suspicious activity related to the plugin. Avoid using the affected plugin versions in untrusted environments. Do not rely on generic mitigations; await vendor guidance for specific patches or updates.