CVE-2026-14433

Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the business id parameter within the REST API endpoint. An attacker can inject arbitrary web scripts into pages that execute automatically when a user accesses the affected page.

Recommendations Update the plugin to a version newer than 4.6.0. As a temporary mitigation, restrict access to the REST API endpoint utilizing the business id parameter.