CVE-2024-5859 is a reflected cross-site scripting vulnerability (CWE-79) in the vcita Online Booking & Scheduling Calendar plugin for WordPress, affecting all versions up to 4.4.2. The vulnerability is due to improper neutralization of input in the 'd' parameter, which allows unauthenticated attackers to inject and execute arbitrary web scripts by tricking users into clicking malicious links. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). No known exploits in the wild have been reported as of the publication date.

Successful exploitation can result in the execution of arbitrary scripts in the context of the affected website, potentially leading to partial disclosure of confidential information and modification of data integrity within the user's session. There is no impact on availability. The vulnerability requires user interaction (clicking a crafted link) and does not require privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin or applying web application firewall (WAF) rules to filter malicious inputs targeting the 'd' parameter. Monitor vendor communications for updates on patches or official fixes.