Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Online Booking & Scheduling Calendar for WordPress by vcita — Vulnerabilities & Security Advisories 20

All 20 CVE vulnerabilities found in Online Booking & Scheduling Calendar for WordPress by vcita, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the vcita Online Booking & Scheduling Calendar plugin for WordPress, categorized by specific weakness types and relevant security tags. The collection encompasses a wide spectrum of reported issues, including cross-site scripting, SQL injection, and unauthorized access flaws, covering the plugin's entire maintenance history from its initial public release to the most recent updates. Visitors can utilize this resource to track the vendor's official security advisories over time, analyze the prevalence and characteristics of specific weakness classes within the WordPress ecosystem, or review the complete vulnerability history of this particular product to assess its long-term security posture. The data presented here is derived from public disclosures and vendor notifications, providing a consolidated view of known risks without requiring users to navigate multiple disparate sources. By examining the chronological progression of these entries, security professionals and site administrators can identify recurring patterns in code quality or update responsiveness. This centralized repository serves as a critical reference for conducting risk assessments, planning remediation strategies, and making informed decisions regarding the continued deployment of the software in production environments. The information remains strictly factual, focusing on the technical nature of the defects and the timeline of their discovery and resolution.

Vendor: vcita

CVE ID Title CVSS Severity Published
CVE-2026-95513 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability CWE-862 7.5 High 2026-09-23
CVE-2025-67559 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability CWE-862 5.4 Medium 2025-12-09
CVE-2025-67472 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 4.3 Medium 2025-12-09
CVE-2025-54677 WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability CWE-434 9.1 Critical 2025-08-20
CVE-2025-54676 WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability CWE-79 6.5 Medium 2025-08-14
CVE-2025-32238 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability CWE-209 4.3 Medium 2025-04-04
CVE-2024-54356 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 5.4 Medium 2024-12-16
CVE-2024-9872 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CWE-79 5.4 Medium 2024-12-06
CVE-2024-47638 WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2024-10-05
CVE-2024-37262 WordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2024-07-22
CVE-2024-37499 WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.2 - Local File Inclusion vulnerability CWE-22 6.5 Medium 2024-07-09
CVE-2024-5791 Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting CWE-79 7.2 High 2024-06-22
CVE-2024-35761 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2024-06-21
CVE-2024-5859 Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting CWE-79 6.1 Medium 2024-06-21
CVE-2023-39992 WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.3.2 is vulnerable to Cross Site Scripting (XSS) CWE-79 7.1 High 2023-09-04
CVE-2023-2414 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload CWE-862 5.4 Medium 2023-06-09
CVE-2023-2416 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout CWE-352 5.4 Medium 2023-06-03
CVE-2023-2298 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting CWE-79 7.2 High 2023-06-03
CVE-2023-2415 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout CWE-862 5.4 Medium 2023-06-03
CVE-2023-2299 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API CWE-862 5.3 Medium 2023-06-03

All 20 known CVE vulnerabilities affecting Online Booking & Scheduling Calendar for WordPress by vcita with full Chinese analysis, references, and POCs where available.