The vulnerability allows an attacker to embed arbitrary JavaScript into any page that renders the booking calendar. Because the data are stored without sanitization or escaping, the malicious code runs whenever any user visits the affected page, enabling cookie theft, session hijacking, and phishing attacks. This is an unauthenticated stored XSS flaw identified as CWE-79.

All installations of the QuickCal WordPress plugin from version 1.0.0 through 1.0.20, inclusive. The affected product is Themovation QuickCal, a booking calendar plugin that displays a shortcode on WordPress pages.

The CVSS score of 7.2 indicates a high severity. The exploit probability (EPSS) is not available, and the issue is not listed in the CISA KEV catalog. The flaw is trivial to exploit because the attacked web pages expose a public nonce for the booked_add_appt AJAX action, which an unauthenticated attacker can retrieve from the page source and use to inject malicious data via custom field parameters. Once injected, the code executes in every user’s browser that visits the infected page.