PatchTheCVEvcita vulnerabilities
Recent CVEs affecting vcita products. 16 tracked.
vcita has 16 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 16. Most recent: 2025-12-09. Highest priority: CVE-2025-54677 (score 41/100).
- CVE-2025-67559 MEDIUM 5.4 UPGRADE Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeti
- CVE-2025-67472 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by
- CVE-2025-54677 CRITICAL 9.1 UPGRADE Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar fo
- CVE-2025-54676 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita On
- CVE-2025-32238 MEDIUM 4.3 UPGRADE Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Schedulin
- CVE-2024-9872 MEDIUM 5.4 UPGRADE The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthor
- CVE-2024-5859 MEDIUM 6.1 UPGRADE The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflecte
- CVE-2024-5791 HIGH 7.2 UPGRADE The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored C
- CVE-2024-54356 MEDIUM 5.4 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by
- CVE-2024-47638 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita On
- CVE-2024-37499 MEDIUM 6.5 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online B
- CVE-2024-37262 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in v
- CVE-2024-35761 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in v
- CVE-2024-13703 MEDIUM 4.3 UPGRADE The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data d
- CVE-2024-13702 MEDIUM 6.4 UPGRADE The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
- CVE-2024-11895 MEDIUM 6.4 UPGRADE The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross
FAQ
How do I fix vcita vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vcita being exploited right now?
None of the tracked vcita CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vcita CVE should I patch first?
CVE-2025-54677 currently ranks highest (41/100): Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar fo.