Vcita
36 CVEs across 11 Vcita products. Browse Vcita vulnerabilities, severities, and proof-of-concept exploits.
Vcita products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14433 | High | 7.2 | 2026-08-15 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' paramet… |
CVE-2025-67559 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrect… |
CVE-2025-67472 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Si… |
CVE-2025-54677 | Critical | 9.1 | 2025-08-20 | Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita a… |
CVE-2025-54676 | Medium | 6.5 | 2025-08-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress… |
CVE-2025-5240 | Medium | 6.4 | 2025-07-22 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and incl… |
CVE-2025-32238 | Medium | 4.3 | 2025-04-04 | Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-schedul… |
CVE-2024-13702 | Medium | 6.4 | 2025-03-26 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSched… |
CVE-2024-13703 | Medium | 4.3 | 2025-03-13 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_aja… |
CVE-2024-11895 | Medium | 6.4 | 2025-02-18 | The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in al… |
CVE-2024-13717 | Medium | 4.3 | 2025-01-31 | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-11886 | Medium | 6.4 | 2025-01-31 | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler ' short… |
CVE-2025-22661 | Medium | 6.5 | 2025-01-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & St… |
CVE-2024-11870 | Medium | 6.4 | 2025-01-15 | The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, a… |
CVE-2024-54356 | Medium | 5.4 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Si… |
CVE-2024-9872 | Medium | 5.4 | 2024-12-06 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2024-47638 | High | 7.1 | 2024-10-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress… |
CVE-2024-37262 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Scheduling Calendar for… |
CVE-2024-37499 | Medium | 6.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vci… |
CVE-2024-5791 | High | 7.2 | 2024-06-22 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in… |
CVE-2024-35761 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for Wor… |
CVE-2024-5859 | Medium | 6.1 | 2024-06-21 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘d’ parameter in a… |
CVE-2023-39992 | High | 7.1 | 2023-09-04 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.3.2 versions. |
CVE-2023-2414 | Medium | 5.4 | 2023-06-09 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2023-2416 | Medium | 5.4 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check o… |
CVE-2023-2415 | Medium | 5.4 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2023-2407 | Medium | 6.1 | 2023-06-03 | The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for W… |
CVE-2023-2406 | Medium | 6.4 | 2023-06-03 | The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for Wo… |
CVE-2023-2405 | Medium | 6.1 | 2023-06-03 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to m… |
CVE-2023-2404 | Medium | 6.4 | 2023-06-03 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and includi… |
CVE-2023-2303 | Medium | 6.1 | 2023-06-03 | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This i… |
CVE-2023-2302 | Medium | 6.4 | 2023-06-03 | The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, an… |
CVE-2023-2301 | Medium | 6.1 | 2023-06-03 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to mis… |
CVE-2023-2300 | Medium | 6.4 | 2023-06-03 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including… |
CVE-2023-2299 | Medium | 5.3 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wo… |
CVE-2023-2298 | High | 7.2 | 2023-06-03 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' paramet… |