CVE-2026-14433 is a stored cross-site scripting vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin. The flaw arises from improper neutralization of input in the 'business_id' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all plugin versions up to and including 4.6.0. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of users who visit the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of user data or session tokens. Availability is not impacted. The vulnerability is rated high severity with a CVSS 3.1 score of 7.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to affected pages or disabling the plugin if feasible. Monitor vendor channels for updates and apply official patches once released.