Log in Start free

vCita

Products

ProductCVEsExploitedLatest
Online Booking & Scheduling Calendar for WordPress by vcita18–Sep 23, 2026
CRM and Lead Management by vcita5–Jul 22, 2025
Online Payments – Get Paid with PayPal, Square & Stripe4–Feb 18, 2025
Contact Form and Calls To Action by vcita3–Jan 31, 2025
Event Registration Calendar By vcita3–Jan 15, 2025
Online Booking & Scheduling Calendar by vcita1–Aug 15, 2026

Exploited and recent CVEs

  • CVE-2026-95513 High 7.5 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability 0.3%
  • CVE-2026-14433 High 7.2 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter 0.4%
  • CVE-2025-67559 Medium 5.4 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability 0.2%
  • CVE-2025-67472 Medium 4.3 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2025-54677 Critical 9.1 WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability 0.4%
  • CVE-2025-54676 Medium 6.5 WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability 0.2%
  • CVE-2025-5240 Medium 6.4 CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter 0.4%
  • CVE-2025-32238 Medium 4.3 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability 0.5%
  • CVE-2024-13702 Medium 6.4 CRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2024-13703 Medium 4.3 CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle 0.3%
  • CVE-2024-11895 Medium 6.4 Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
  • CVE-2024-13717 Medium 4.3 Contact Form and Calls To Action by vcita <= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Toggle 0.3%
  • CVE-2024-11886 Medium 6.4 Contact Form and Calls To Action by vcita <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2025-22661 Medium 6.5 WordPress Online Payments plugin <= 3.20.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2024-11870 Medium 6.4 Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
  • CVE-2024-54356 Medium 5.4 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-9872 Medium 5.4 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-47638 High 7.1 WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-37499 Medium 6.5 WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.2 - Local File Inclusion vulnerability 0.6%
  • CVE-2024-5791 High 7.2 Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting 0.3%
  • CVE-2024-35761 Medium 6.5 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-5859 Medium 6.1 Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting 0.3%
  • CVE-2023-2414 Medium 5.4 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload 0.5%
  • CVE-2023-2416 Medium 5.4 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout 0.4%
  • CVE-2023-2404 Medium 6.4 CRM and Lead Management by vcita <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.6%
  • CVE-2023-2298 High 7.2 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting 0.6%
  • CVE-2023-2415 Medium 5.4 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout 0.7%
  • CVE-2023-2302 Medium 6.4 Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
  • CVE-2023-2299 Medium 5.3 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API 0.6%
  • CVE-2023-2407 Medium 6.1 Event Registration Calendar By vcita <= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe <= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting 0.4%