CVE-2026-15984: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Themovation QuickCal

CVE-2026-15984 describes a stored cross-site scripting vulnerability in Themovation's QuickCal WordPress plugin versions up to and including 1.0.20. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of custom field parameters. An unauthenticated attacker can inject arbitrary scripts that execute in the context of users visiting the affected pages. The nonce intended to protect the unauthenticated booked_add_appt AJAX action is publicly embedded on pages rendering the booking calendar shortcode, making it easily accessible to attackers without requiring authentication or privileges.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of users visiting injected pages, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected site. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 score is 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the QuickCal plugin or removing the booking calendar shortcode from publicly accessible pages to reduce exposure. Monitoring vendor channels for updates is recommended.