CVE-2026-14433 is a stored cross-site scripting vulnerability (CWE-79) in the Online Booking & Scheduling Calendar for WordPress by vcita plugin. The flaw exists in the handling of the 'business_id' parameter, which is not properly sanitized or escaped, allowing attackers to inject malicious scripts that execute in the context of users visiting the affected pages. This affects all versions up to and including 4.6.0. The CVSS 3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

An unauthenticated attacker can exploit this vulnerability to inject and execute arbitrary scripts in the context of users visiting the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity of user data. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vcita's official channels for updates. Until a patch is available, consider restricting access to affected parameters or applying web application firewall (WAF) rules to block malicious input targeting the 'business_id' parameter.