What is the CVSS score of CVE-2026-14433?

CVE-2026-14433 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of vcita Booking Calendar are affected by CVE-2026-14433?

The vcita WordPress booking plugin (versions through 4.6.0) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts that execute for all…

How to fix or mitigate CVE-2026-14433?

Within 24 hours, conduct a complete inventory of all WordPress installations running the vcita plugin and document currently deployed versions. Immediately disable the plugin if it is not critical to customer-facing operations, and communicate the vulnerability status to relevant stakeholders. Within 7 days, contact vcita support to inquire about patch timelines, implement web application firewall rules to block or sanitize the 'business_id' parameter, and review administrator account access logs for any anomalous activity. Over the next 30 days, evaluate alternative scheduling plugins that are actively maintained with security patches, plan a migration timeline if vcita remains unpatched, and establish continuous monitoring for exploit attempts targeting the business_id parameter.

vcita Booking Calendar CVE-2026-14433

EUVD-2026-58833 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-15 Wordfence

GHSA-835v-66hv-vq5w

WordPress XSS Wordpress Plugin Online Booking Scheduling Calendar For Wordpress By Vcita Vcita

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Stored XSS injection requires no auth (PR:N), but payload execution requires a victim to load the page (UI:R); scope change (S:C) reflects cross-boundary browser execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 02:59 vuln.today

CVE Published

Aug 15, 2026 - 02:26 cve.org

HIGH 7.2

DescriptionCVE.org

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Online Booking & Scheduling Calendar for WordPress by vcita (all versions through 4.6.0) allows unauthenticated remote attackers to inject persistent malicious JavaScript via the unsanitized 'business_id' parameter. Injected scripts execute in the browser of any user - including administrators - who subsequently loads an affected page, enabling session hijacking, credential theft, or secondary payload delivery. No active exploitation is confirmed by CISA KEV; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerable code paths in three specific source files.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The affected plugin, identified by CPE cpe:2.3:a:vcita:online_booking_&_scheduling_calendar_for_wordpress_by_vcita:*:*:*:*:*:*:*:*, is a WordPress scheduling integration plugin for the vcita SaaS platform. Wordfence references three specific vulnerable code locations: vcita-widgets-functions.php at line 22, vcita-api-functions.php at lines 17 and 83, and vcita-scheduler.php at line 379 - indicating the 'business_id' parameter is handled across multiple files without consistent input sanitization or context-aware output escaping. The CVSS vector confirms scope change (S:C), meaning the injected script crosses the trust boundary from the WordPress server context into the victim's browser context, which is the canonical behavior of XSS.

RemediationAI

No vendor-released patched version has been identified in the available data - all references point to the 4.6.0 source code (the affected version), and no fixed release tag is referenced. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3fbfb185-d901-4789-9a13-137f72234ed4 for patch availability. As a compensating control, consider deactivating the plugin until a patched version is confirmed; the trade-off is loss of booking functionality for site visitors. A Web Application Firewall (WAF) with WordPress-aware XSS rules - such as those offered by Wordfence itself - can block exploitation attempts at the perimeter without requiring plugin deactivation. Restricting access to the booking form pages to authenticated users only would eliminate the unauthenticated injection surface but may conflict with the plugin's intended public-facing use case.