The vcita Online Booking & Scheduling Calendar WordPress plugin suffers from an improper neutralization of input vulnerability (CWE-79) caused by a missing capability check in the vcita_save_user_data_callback() function. This flaw enables authenticated users with low privileges (Subscriber-level and above) to inject malicious web scripts and alter plugin settings. The vulnerability is present in all versions up to 4.5.1. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the user level with user interaction needed. The impact includes limited confidentiality and integrity loss but no availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker with at least Subscriber-level access can exploit this vulnerability to inject malicious scripts into the plugin's web pages and modify plugin settings without proper authorization. This could lead to limited confidentiality and integrity compromise within the affected WordPress site. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to the plugin. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from vcita for any forthcoming patches or official mitigations.