What’s Vulnerable › Products

vcita Online Booking & Scheduling Calendar for WordPress by vcita vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your vcita Online Booking & Scheduling Calendar for WordPress by vcita version is affected

Latest vcita Online Booking & Scheduling Calendar for WordPress by vcita vulnerabilities

• CVE-2026-95513 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2025-67559 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2025-67472 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
• CVE-2025-54677 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability (CVSS 7.2)
• CVE-2025-54676 — WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.4)
• CVE-2025-32238 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability (CVSS 4.3)
• CVE-2024-54356 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
• CVE-2024-9872 — Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-47638 — WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-37262 — WordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-37499 — WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.2 - Local File Inclusion vulnerability (CVSS 6.5)
• CVE-2024-5791 — Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
• CVE-2024-35761 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2024-5859 — Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting (CVSS 6.1)
• CVE-2023-39992 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
• CVE-2023-2414 — Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload (CVSS 4.3)
• CVE-2023-2416 — Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout (CVSS 6.5)
• CVE-2023-2415 — Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout (CVSS 5.4)
• CVE-2023-2299 — Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API (CVSS 5.3)
• CVE-2023-2298 — Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)