EUVD-2026-71885
GHSA-3566-c9r4-mj76
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to load the injected page before execution, so UI:R is more accurate than the submitted UI:N; all other metrics align with the described unauthenticated network attack with scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege.
AnalysisAI
Stored Cross-Site Scripting in the QuickCal WordPress appointment booking plugin (all versions ≤ 1.0.20) permits unauthenticated remote attackers to inject persistent JavaScript payloads into pages rendered by the booking calendar. The attack is enabled by a design flaw in which the nonce protecting the booked_add_appt AJAX action is publicly embedded in any page displaying the booking shortcode, completely nullifying its role as an access control mechanism and allowing any visitor to submit malicious input without credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must have QuickCal version 1.0.20 or earlier installed and active, and the booking calendar shortcode must be rendered on at least one publicly accessible (unauthenticated) page - this page is the source from which attackers retrieve the exposed nonce. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The submitted CVSS 7.2 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) warrants scrutiny on the UI:N metric: stored XSS requires a victim to navigate to the injected page before the payload fires, which technically implies UI:R rather than UI:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version has been confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations for QuickCal plugin presence and disable the plugin immediately if business operations permit. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today