CVE-2024-5791: Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpid' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a wp-admin dashboard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vcita WordPress plugin (Appointment Booking and Online Scheduling)to a version that resolves this vulnerability.Fixed in 4.4.2 - Configuration
Fix the missing authorization checks in the processAction function so that unauthenticated requests cannot trigger the Stored XSS via the wp_id parameter.
vcita WordPress plugin (Appointment Booking and Online Scheduling) processAction authorization checks for wp_id = Require authenticated/authorized requests before processing wp_id - Configuration
Add proper input sanitization for the wp_id parameter and ensure all data derived from wp_id is correctly escaped on output to prevent stored cross-site scripting.
vcita WordPress plugin (Appointment Booking and Online Scheduling) wp_id input sanitization and output escaping = Sanitize incoming wp_id and escape output - Compensating control
Restrict access to the affected wp-admin dashboard area (e.g., via network/WAF/ACL) so that only authenticated/authorized users can reach the dashboard where the injected scripts would execute.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5791?
CVE-2024-5791 is considered a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-5791?
To fix CVE-2024-5791, update the vcita Online Booking & Scheduling Calendar for WordPress plugin to version 4.4.3 or later.
Which versions of the vcita plugin are affected by CVE-2024-5791?
CVE-2024-5791 affects all versions of the vcita plugin for WordPress up to and including version 4.4.2.
What is the impact of CVE-2024-5791 on my WordPress site?
CVE-2024-5791 allows attackers to execute arbitrary scripts on your site, potentially compromising user data and the integrity of the site.
Is my site immediately at risk if I use an affected version for CVE-2024-5791?
Yes, if you are using an affected version of the vcita plugin, your site is at risk of being exploited due to the vulnerability.