CVE-2023-2298

Deeper analysis

The Online Booking & Scheduling Calendar for WordPress by vcita plugin is affected by a stored cross-site scripting vulnerability (CWE-79) in versions up to and including 4.3.0. The flaw resides in insufficient input sanitization and output escaping of the business_id parameter, allowing malicious payloads to be persisted and later rendered in plugin-generated pages.

Unauthenticated attackers can supply crafted input over the network to inject arbitrary scripts. Because the attack requires no credentials or user interaction and affects the scope of the vulnerable site, successful exploitation can result in limited confidentiality and integrity impacts when any visitor loads an injected page.

Public references point to a fix committed in the plugin's vcita-api-functions.php file, and Wordfence advisory data confirm that updating to a patched release addresses the input-handling weakness. Site administrators should apply the latest plugin version and verify that business_id values are properly escaped on output.

EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0646 before receding to the current value of 0.0391, indicating a measurable increase in exploitation interest after disclosure.