Online Booking & Scheduling Calendar by vcita
Online Booking & Scheduling Calendar by vcita has 21 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 21 are fixed as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 5 high. 2024 was the busiest year with 8 disclosures.
The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 10 of the records (48%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery.
Every one of the 21 issues recorded for Online Booking & Scheduling Calendar by vcita has a vendor fix available, so running the current release closes all known holes.
14 independent researchers contributed these findings, most of them (5) reported by Jonas Höbenreich. Online Booking & Scheduling Calendar by vcita is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2025-54677Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Author+) Arbitrary File Upload
Read the full analysisVulnerability Records
Online Booking & Scheduling Calendar by vcita
Author
vcita
vcita is the #1 scheduling software for service based business. Trusted by over 100,000 users worldwide! vcita’s appointment booking and online scheduling plugin for WordPress offers a self-service scheduling software for online sessions, 1-on-1 appointments, group events and classes. Convert website visitors to paying customers with online bookings: Take online appointments requests Enable online booking and rescheduling Offer registration for online sessions, 1:1 appointments, classes and events Register for events, sign up for classes Pay for services and view their invoices / receipts Offer online services via Zoom Accept secure online payments Key booking features: Business calendar for you and your staff Unlimited bookings and service list All service types: online, 1:1 appointments, classes and events Customizable services and grouping into categories Customizable business hours & booking preferences Business calendar for you and your staff Personalized branding and online appearance Email & TXT notifications, reminders & follow ups Customizable booking form * Staff members roles and permissions management * Adjust to any time zone Sync with Google calendar / iCal / Outlook * Available in 11 languages – EN, EN GB, FR, ES, IT, PT, RU, DE, PL, NL, HE * Advanced analytics and export options Who is vcita good for? vcita was designed for service professionals and appointment-based businesses. With vcita, businesses at any size can accept bookings & payments 24/7 and manage their clients, schedule, and team from one centralized dashboard. From beauty Salons to business consultants, therapists and personal trainers, vcita fits any business, anywhere. Why business owners love vcita? Mobile app: your own office station, perfect for work on-the-go Instant availability: clients can self-book and pay 24/7 Get paid anywhere: choose between PayPal, Square or Stripe No surprises: TXT appointment reminders eliminate no-shows Exceptional client service: safe and secure self-service portal One app, one power house of advanced features: Take bookings 24/7 Accept payments online, offline & on-the-go Send TXT & email appointment and payment reminders Issue green invoices, receipts & price estimates Keep neat client list and history records Invite team members to collaborate Add lead capturing widgets to your website – Multi contact form, newsletter subscribers, booking & payment widgets Offer clients a secure and professional self-service portal Send email marketing campaigns and coupons Available integrations: Gmail / iCal / Outlook Zoom Facebook Google My Business Reserve with Google QuickBooks Square Stripe Zapier PayPal We are here 24/7/365 contact us Join Facebook’s user community Visit vcita help center Enjoying vcita? Love us back: Rate vcita 5 stars Join the partners program Follow vcita Facebook Linkedin Instagram Youtube FREE 14 DAYS TRIAL. No credit card needed
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C