CVE-2026-15984

Name of the Vulnerable Software and Affected Versions QuickCal versions prior to 1.0.21

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. Attackers can inject arbitrary web scripts into pages via custom field parameters. These scripts execute when a user accesses the affected page. The booked add appt AJAX action is protected by a nonce (a unique token used to prevent replay attacks) that is publicly embedded on any page rendering the booking calendar shortcode, allowing unauthenticated users to obtain it easily.

Recommendations Update QuickCal to version 1.0.21 or later.