Input validation vulnerability in Online Booking & Scheduling Calendar for WordPress by vcita 4.2.10

The vcita plugin for WordPress, which is used for Online Booking & Scheduling Calendar for WordPress, is vulnerable to a type of attack called Stored Cross-Site Scripting. This type of attack happens when unauthenticated attackers inject malicious code into a website, and when users visit the website, the code is executed. In this case, the vulnerability is present in versions up to 4.2.10 because the ‘business_id’ parameter is not being sanitized or escaped properly, meaning the malicious code can be injected into the website.