Online Booking & Scheduling Calendar for WordPress by vcita < 4.4.3 - Unauthenticated Stored XSS

Description

The plugin does not validate authorization in its vcita-wordpress/v1/actions/auth REST route endpoint, allowing an unauthenticated attacker to set the connection parameters for the vcita account connection, including business_name and email address. Furthermore, the variables are stored in the database without any validation and are later inserted into the website without escaping or sanitation, leading to a stored cross-site scripting vulnerability.