https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-67559.htmlhttps://patchthecve.com/cve/CVE-2025-67559.htmlWed, 14 Oct 2026 21:10:00 +0000MEDIUM 5.4: Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a throughhttps://patchthecve.com/cve/CVE-2025-67472.htmlhttps://patchthecve.com/cve/CVE-2025-67472.htmlWed, 14 Oct 2026 21:10:00 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.https://patchthecve.com/cve/CVE-2025-54677.htmlhttps://patchthecve.com/cve/CVE-2025-54677.htmlWed, 17 Jun 2026 09:40:30 +0000CRITICAL 9.1: Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.3.https://patchthecve.com/cve/CVE-2025-54676.htmlhttps://patchthecve.com/cve/CVE-2025-54676.htmlWed, 17 Jun 2026 09:40:30 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/https://patchthecve.com/cve/CVE-2025-32238.htmlhttps://patchthecve.com/cve/CVE-2025-32238.htmlWed, 17 Jun 2026 09:11:39 +0000MEDIUM 4.3: Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a https://patchthecve.com/cve/CVE-2024-13702.htmlhttps://patchthecve.com/cve/CVE-2024-13702.htmlWed, 17 Jun 2026 07:02:34 +0000MEDIUM 6.4: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supphttps://patchthecve.com/cve/CVE-2024-13703.htmlhttps://patchthecve.com/cve/CVE-2024-13703.htmlWed, 17 Jun 2026 07:02:34 +0000MEDIUM 4.3: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae() function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-levelhttps://patchthecve.com/cve/CVE-2024-11895.htmlhttps://patchthecve.com/cve/CVE-2024-11895.htmlWed, 17 Jun 2026 06:58:39 +0000MEDIUM 6.4: The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ithttps://patchthecve.com/cve/CVE-2024-54356.htmlhttps://patchthecve.com/cve/CVE-2024-54356.htmlWed, 17 Jun 2026 08:10:11 +0000MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.https://patchthecve.com/cve/CVE-2024-9872.htmlhttps://patchthecve.com/cve/CVE-2024-9872.htmlWed, 17 Jun 2026 08:25:25 +0000MEDIUM 5.4: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_user_data_callback() function in all versions up to, and including, 4.5.1. This makes it possible for authenticahttps://patchthecve.com/cve/CVE-2024-47638.htmlhttps://patchthecve.com/cve/CVE-2024-47638.htmlWed, 17 Jun 2026 07:57:26 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: fromhttps://patchthecve.com/cve/CVE-2024-37262.htmlhttps://patchthecve.com/cve/CVE-2024-37262.htmlWed, 17 Jun 2026 07:38:01 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4https://patchthecve.com/cve/CVE-2024-37499.htmlhttps://patchthecve.com/cve/CVE-2024-37499.htmlWed, 17 Jun 2026 07:38:28 +0000MEDIUM 6.5: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Path Traversal.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.2.https://patchthecve.com/cve/CVE-2024-5791.htmlhttps://patchthecve.com/cve/CVE-2024-5791.htmlWed, 17 Jun 2026 08:16:39 +0000HIGH 7.2: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input sanitizhttps://patchthecve.com/cve/CVE-2024-35761.htmlhttps://patchthecve.com/cve/CVE-2024-35761.htmlWed, 17 Jun 2026 07:35:19 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.0.https://patchthecve.com/cve/CVE-2024-5859.htmlhttps://patchthecve.com/cve/CVE-2024-5859.htmlWed, 17 Jun 2026 08:16:47 +0000MEDIUM 6.1: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘d’ parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate