Online Booking & Scheduling Calendar for WordPress by vcita

Online Booking & Scheduling Calendar for WordPress by vcita has 20 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 19 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 5 high. 2024 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 10 of the records (50%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).

19 of the records (95%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

13 independent researchers contributed these findings, most of them (5) reported by Jonas Höbenreich.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage95%

Open

Fixed

Get automatic notifications for all Online Booking & Scheduling Calendar for WordPress by vcita vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-14433

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter

Read the full analysis

Vulnerability Records

20 records


2026-08-14 14:02	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter Online Booking & Scheduling Calendar… <= 4.6.0	`CVE-2026-14433`	7.2 High	MatilJ	No
2025-11-12 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Cross-Site Request Forgery Online Booking & Scheduling Calendar… <= 4.5.5	`CVE-2025-67472`	4.3 Medium	Kévin Mosbahi (Mika)	Yes
2025-11-12 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Missing Authorization Online Booking & Scheduling Calendar… <= 4.5.5	`CVE-2025-67559`	4.3 Medium	Kévin Mosbahi (Mika)	Yes
2025-08-14 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Author+) Arbitrary File Upload Online Booking & Scheduling Calendar… <= 4.5.3	`CVE-2025-54677`	8.8 High	Que Thanh Tuan - Blue Rock	Yes
2025-07-30 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Online Booking & Scheduling Calendar… <= 4.5.3	`CVE-2025-54676`	6.4 Medium	Que Thanh Tuan - Blue Rock	Yes
2025-04-04 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.2 - Authenticated (Subscriber+) Sensitive Information Exposure Online Booking & Scheduling Calendar… <= 4.5.2	`CVE-2025-32238`	4.3 Medium	Joshua Chan	Yes
2024-12-11 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery Online Booking & Scheduling Calendar… <= 4.5	`CVE-2024-54356`	4.3 Medium	Marek Mikita	Yes
2024-12-05 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Online Booking & Scheduling Calendar… <= 4.5.1	`CVE-2024-9872`	5.4 Medium	stealthcopter	Yes
2024-09-30 00:00	Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Reflected Cross-Site Scripting Online Booking & Scheduling Calendar… <= 4.4.6	`CVE-2024-47638`	6.1 Medium	Abdi Pranata	Yes
2024-07-17 00:00	vCita Online Booking & Scheduling Calendar <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Online Booking & Scheduling Calendar… <= 4.4.0	`CVE-2024-35761`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes

Showing 1–10 of 20 reports