Advisories · Technology

Online Booking & Scheduling Calendar for WordPress by vcita.

Every CVE that names Online Booking & Scheduling Calendar for WordPress by vcita among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-95513 CVE record

CVSS 7.5 High

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2025-67559 CVE record

CVSS 5.4 Medium

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Broken access control
Not analysed yet 9 Dec 2025
CVE-2025-67472 CVE record

CVSS 4.3 Medium

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site request forgery (CSRF)
Not analysed yet 9 Dec 2025
CVE-2025-54677 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Unrestricted file upload
Not analysed yet 20 Aug 2025
CVE-2025-54676 CVE record

CVSS 6.5 Medium

WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site scripting (XSS)
Not analysed yet 14 Aug 2025
CVE-2025-32238 CVE record

CVSS 4.3 Medium

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Information disclosure
Not analysed yet 4 Apr 2025
CVE-2024-54356 CVE record

CVSS 5.4 Medium

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site request forgery (CSRF)
Not analysed yet 16 Dec 2024
CVE-2024-9872 CVE record

CVSS 5.4 Medium

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site scripting (XSS)
Not analysed yet 6 Dec 2024
CVE-2024-47638 CVE record

CVSS 7.1 High

WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site scripting (XSS)
Not analysed yet 5 Oct 2024
CVE-2024-37499 CVE record

CVSS 6.5 Medium

WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.2 - Local File Inclusion vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Path traversal
Not analysed yet 9 Jul 2024
CVE-2024-5791 CVE record

CVSS 7.2 High

Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site scripting (XSS)
Not analysed yet 22 Jun 2024
CVE-2024-35761 CVE record

CVSS 6.5 Medium

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site scripting (XSS)
Not analysed yet 21 Jun 2024
CVE-2024-5859 CVE record

CVSS 6.1 Medium

Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site scripting (XSS)
Not analysed yet 21 Jun 2024
CVE-2023-2414 CVE record

CVSS 5.4 Medium

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload
- Online Booking & Scheduling Calendar for WordPress by vcita
- Broken access control
Not analysed yet 9 Jun 2023
CVE-2023-2416 CVE record

CVSS 5.4 Medium

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site request forgery (CSRF)
Not analysed yet 3 Jun 2023
CVE-2023-2298 CVE record

CVSS 7.2 High

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting
- Online Booking & Scheduling Calendar for WordPress by vcita
- Cross-site scripting (XSS)
Not analysed yet 3 Jun 2023
CVE-2023-2415 CVE record

CVSS 5.4 Medium

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout
- Online Booking & Scheduling Calendar for WordPress by vcita
- Broken access control
Not analysed yet 3 Jun 2023
CVE-2023-2299 CVE record

CVSS 5.3 Medium

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API
- Online Booking & Scheduling Calendar for WordPress by vcita
- Broken access control
Not analysed yet 3 Jun 2023