CVE-2026-15984: QuickCal WordPress Plugin XSS Vulnerability

CVE-2026-15984 Overview

The QuickCal appointment booking plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.0.20. The flaw stems from insufficient input sanitization and output escaping on Custom Field Parameters processed by the booked_add_appt AJAX action. Unauthenticated attackers can inject arbitrary JavaScript that executes when any user renders the affected page. The nonce protecting the AJAX action is embedded publicly in any page that renders the booking calendar shortcode, so attackers can retrieve it without authentication. This vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can persistently inject JavaScript into WordPress pages, enabling session theft, credential harvesting, and administrative account takeover when victims view booking calendar content.

Affected Products

QuickCal Appointment Booking Calendar for WordPress — all versions through 1.0.20
WordPress sites rendering the QuickCal booking calendar shortcode
Any site exposing the unauthenticated booked_add_appt AJAX action

Discovery Timeline

2026-09-05 - CVE-2026-15984 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-15984

Vulnerability Analysis

The QuickCal plugin exposes a booked_add_appt AJAX endpoint intended to accept new appointment submissions from public visitors. The handler processes user-supplied Custom Field Parameters that are later rendered in administrative or booking pages. Because these fields are neither sanitized on input nor escaped on output, attacker-controlled markup persists in the database and executes in the victim's browser.

The attack does not require authentication. The nonce that normally gates the AJAX action is emitted directly into any page rendering the booking calendar shortcode, so an unauthenticated attacker can scrape it and submit forged requests. Successful exploitation lets attackers execute JavaScript in the context of any user, including administrators, which can lead to session hijacking, arbitrary WordPress configuration changes, or full site takeover.

Root Cause

The root cause is missing input sanitization and missing output escaping for Custom Field Parameters submitted through the booked_add_appt AJAX action. WordPress helpers such as sanitize_text_field(), wp_kses(), and esc_html() are not applied to the fields before storage or rendering. The nonce-based authorization control is also ineffective because the token is publicly disclosed on shortcode-rendered pages.

Attack Vector

Exploitation occurs over the network with no privileges and no user interaction. An attacker loads a page containing the QuickCal booking calendar shortcode, extracts the embedded nonce, and issues a crafted POST request to the admin-ajax.php endpoint with the booked_add_appt action and a malicious Custom Field payload. The payload persists in the site database and executes when a user, including a site administrator, views the compromised page. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-15984

Indicators of Compromise

Appointment records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> inside Custom Field values
Unexpected outbound requests from admin browsers to attacker-controlled domains after viewing the booking calendar
Anomalous POST requests to wp-admin/admin-ajax.php with action=booked_add_appt from unauthenticated sources
New or unexpected WordPress administrator accounts created shortly after admin sessions on affected pages

Detection Strategies

Review the QuickCal appointment tables in the WordPress database for stored HTML or JavaScript in Custom Field columns
Inspect web server access logs for high-volume or scripted requests to admin-ajax.php referencing booked_add_appt
Deploy a Web Application Firewall (WAF) rule that inspects booked_add_appt payloads for HTML control characters and event handler attributes

Monitoring Recommendations

Alert on WordPress plugin file modifications and new admin user creation events
Monitor administrator browser sessions for unexpected outbound connections after accessing booking-related pages
Ingest WordPress and web server logs into a centralized analytics platform to correlate anonymous AJAX activity with subsequent admin actions

How to Mitigate CVE-2026-15984

Immediate Actions Required

Disable or deactivate the QuickCal plugin on all WordPress sites until a patched version is installed
Remove or unpublish pages containing the QuickCal booking calendar shortcode to prevent nonce disclosure
Audit the appointments database and purge any records containing script tags or HTML event handlers in Custom Field values
Force password rotation and session invalidation for all WordPress administrator accounts that may have accessed affected pages

Patch Information

No fixed version is listed in the NVD entry at the time of publication. All QuickCal releases up to and including 1.0.20 are affected. Monitor the QuickCal CodeCanyon product page and the Wordfence Vulnerability Report for a patched release and upgrade as soon as it becomes available.

Workarounds

Restrict access to admin-ajax.php for the booked_add_appt action at the WAF or reverse proxy layer
Apply Content Security Policy (CSP) headers that block inline script execution on WordPress pages
Remove the booking calendar shortcode from public pages to prevent nonce harvesting by unauthenticated visitors
Isolate WordPress administrator sessions in a dedicated browser profile to reduce the blast radius of stored XSS payloads

bash

# Example nginx rule to block unauthenticated booked_add_appt requests
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "booked_add_appt") {
        return 403;
    }
}