The vulnerability CVE-2025-54676 in vcita's Online Booking & Scheduling Calendar for WordPress is a stored cross-site scripting (XSS) flaw caused by improper input sanitization during web page generation. This allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The affected versions include all releases up to 4.5.3. The CVSS 3.1 base score is 6.5, indicating a medium severity level. No patch or vendor advisory has been provided to confirm remediation status.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system due to script execution in users' browsers. The attacker requires low privileges and user interaction to trigger the vulnerability. There are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin and monitoring for suspicious activity. Avoid interacting with untrusted input in the plugin interface. Follow updates from vcita for any released patches or mitigations.