Quickcal
Monthly
Stored Cross-Site Scripting in the QuickCal WordPress appointment booking plugin (all versions ≤ 1.0.20) permits unauthenticated remote attackers to inject persistent JavaScript payloads into pages rendered by the booking calendar. The attack is enabled by a design flaw in which the nonce protecting the `booked_add_appt` AJAX action is publicly embedded in any page displaying the booking shortcode, completely nullifying its role as an access control mechanism and allowing any visitor to submit malicious input without credentials. Once stored, the payload executes in the browser context of every subsequent user who views an injected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the QuickCal WordPress appointment booking plugin (all versions ≤ 1.0.20) permits unauthenticated remote attackers to inject persistent JavaScript payloads into pages rendered by the booking calendar. The attack is enabled by a design flaw in which the nonce protecting the `booked_add_appt` AJAX action is publicly embedded in any page displaying the booking shortcode, completely nullifying its role as an access control mechanism and allowing any visitor to submit malicious input without credentials. Once stored, the payload executes in the browser context of every subsequent user who views an injected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.