The plugin contains a stored XSS flaw caused by an unsanitized 'business_id' parameter in its REST API. This vulnerability lets an unauthorized user place malicious scripts that will be persisted and executed whenever a page using that parameter is loaded by any visitor. The flaw can be exploited without authentication and resides in the code responsible for handling the parameter's output, classifying it as a classic injection weakness.

All WordPress installations that have the Online Booking & Scheduling Calendar by vcita plugin at version 4.6.0 or earlier are vulnerable. The issue spans every site using the plugin in that version range, regardless of other configurations.

The CVSS score of 7.2 indicates a high severity. With no EPSS score available and the vulnerability not present in the CISA KEV catalog, formal exploitation data is limited, but the attack vector is likely an unauthenticated REST API request. An attacker can craft a malicious 'business_id' value, store it via the API, and when any user visits the affected page the injected script will run in the victim’s browser, potentially stealing session cookies or performing further actions on behalf of the user.