# cve.now: Vcita

The newest entries naming Vcita as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-95513](https://cve.now/CVE-2026-95513.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.6.0 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-14433](https://cve.now/CVE-2026-14433.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business\_id' Parameter (CVSS 7.2)
- [CVE-2025-67559](https://cve.now/CVE-2025-67559.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5.5 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-67472](https://cve.now/CVE-2025-67472.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-54677](https://cve.now/CVE-2025-54677.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin \<= 4.5.3 - Arbitrary File Upload Vulnerability (CVSS 9.1)
- [CVE-2025-54676](https://cve.now/CVE-2025-54676.md): WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin \<= 4.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-5240](https://cve.now/CVE-2025-5240.md): CRM and Lead Management by vcita \<= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter (CVSS 6.4)
- [CVE-2025-32238](https://cve.now/CVE-2025-32238.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5.5 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2024-13702](https://cve.now/CVE-2024-13702.md): CRM and Lead Management by vcita \<= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13703](https://cve.now/CVE-2024-13703.md): CRM and Lead Management by vcita \<= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle (CVSS 4.3)
- [CVE-2024-11895](https://cve.now/CVE-2024-11895.md): Online Payments – Get Paid with PayPal, Square & Stripe \<= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13717](https://cve.now/CVE-2024-13717.md): Contact Form and Calls To Action by vcita \<= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Toggle (CVSS 4.3)
- [CVE-2024-11886](https://cve.now/CVE-2024-11886.md): Contact Form and Calls To Action by vcita \<= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-22661](https://cve.now/CVE-2025-22661.md): WordPress Online Payments plugin \<= 3.20.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-11870](https://cve.now/CVE-2024-11870.md): Event Registration Calendar By vcita \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-54356](https://cve.now/CVE-2024-54356.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-9872](https://cve.now/CVE-2024-9872.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-47638](https://cve.now/CVE-2024-47638.md): WordPress Online Booking & Scheduling Calendar for WordPress plugin \<= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-37499](https://cve.now/CVE-2024-37499.md): WordPress Online Booking & Scheduling Calendar for WordPress plugin \<= 4.4.2 - Local File Inclusion vulnerability (CVSS 6.5)
- [CVE-2024-5791](https://cve.now/CVE-2024-5791.md): Appointment Booking and Online Scheduling \<= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-35761](https://cve.now/CVE-2024-35761.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-5859](https://cve.now/CVE-2024-5859.md): Appointment Booking and Online Scheduling \<= 4.4.2 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2023-2414](https://cve.now/CVE-2023-2414.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload (CVSS 5.4)
- [CVE-2023-2416](https://cve.now/CVE-2023-2416.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.5 - Cross-Site Request Forgery to Account Logout (CVSS 5.4)
- [CVE-2023-2404](https://cve.now/CVE-2023-2404.md): CRM and Lead Management by vcita \<= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-2298](https://cve.now/CVE-2023-2298.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.3.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2023-2415](https://cve.now/CVE-2023-2415.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.2.10 - Missing Authorization to Account Logout (CVSS 5.4)
- [CVE-2023-2302](https://cve.now/CVE-2023-2302.md): Contact Form and Calls To Action by vcita \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-2299](https://cve.now/CVE-2023-2299.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.4.2 - Missing Authorization on REST-API (CVSS 5.3)
- [CVE-2023-2407](https://cve.now/CVE-2023-2407.md): Event Registration Calendar By vcita \<= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe \<= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2023-2406](https://cve.now/CVE-2023-2406.md): Event Registration Calendar By vcita \<= 1.3.1 & Online Payments – Get Paid with PayPal, Square & Stripe \<= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-2405](https://cve.now/CVE-2023-2405.md): CRM and Lead Management by vcita \<= 2.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/vcita
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.