CVE-2026-15984

QuickCal, a WordPress booking-calendar plugin, fails to adequately sanitize and escape custom field parameters submitted to its unauthenticated booked_add_appt AJAX action, allowing attackers to persist arbitrary web scripts in pages (Stored XSS, CWE-79). Although the action is nominally protected by a nonce, that nonce is publicly embedded in the HTML of any page rendering the booking calendar shortcode, so an unauthenticated attacker can trivially retrieve it and forge malicious booking submissions without any account or privileges. Injected scripts execute in the browser of any user who views an affected page, enabling actions in the site's context such as session hijacking, redirects, or malicious content injection. Any WordPress site running QuickCal version 1.0.20 or earlier is affected. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS is low at 0.2%, and exploitation has not been observed in the wild.

What to do: Update QuickCal to a version newer than 1.0.20 as soon as a patched release is available (no fixed version number is specified in the available data, so verify the vendor's changelog). As interim mitigation, deactivate the plugin or remove the booking calendar shortcode from exposed pages, and audit stored appointment/custom field data for injected scripts or unexpected HTML. Note that while nonce protection is bypassed by design, keeping the plugin updated is the only durable fix.