CVE-2026-14433 vcita CVE debrief

Who should care

Users of the Online Booking & Scheduling Calendar for WordPress by vcita plugin, particularly those with versions up to and including 4.6.0, should be aware of this vulnerability and take necessary defensive actions. Affected operators, platforms, and security teams should prioritize patching and implement compensating controls for exposed systems.

Technical summary

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability has a high impact on the confidentiality, integrity, and availability of the affected systems. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. The vulnerability can be mitigated by implementing input validation and output encoding for the 'business_id' parameter, monitoring for suspicious activity, and implementing compensating controls.

Defensive priority

High-priority defensive actions are required to address this vulnerability.

Recommended defensive actions

• Apply the latest patch or update to version 4.6.1 or later
• Implement input validation and output encoding for the 'business_id' parameter
• Monitor for suspicious activity and implement compensating controls
• Conduct inventory checks to identify affected systems
• Exception tracking and retest procedures should be in place
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. Evidence from the CVE record and NVD detail indicates that the Online Booking & Scheduling Calendar for WordPress by vcita plugin is vulnerable to Stored Cross-Site Scripting. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources