Vcita develops a suite of business-management and customer-engagement tools centered on scheduling, CRM, lead management, and payment processing, serving small businesses and service providers. The vulnerability profile reflects application-layer risks endemic to web-facing SaaS platforms: cross-site scripting, cross-site request forgery, missing authorization controls, and path traversal, alongside information-disclosure weaknesses in error handling. Defenders should review access controls and input-sanitization practices in Vcita integrations and treat authorization gaps as high-priority since they may expose customer data or payment flows. Live severity, exploitation, and detailed CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vcita over time
Signals from CVEs in this vendor scope (34 CVEs).
34 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-67472HIGH Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.Th | Dec 9, 2025 | 8.8 | 26 | NO | NO |
CVE-2025-54677HIGH Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious | Aug 20, 2025 | 7.2 | 25 | NO | NO |
CVE-2023-2303MEDIUM The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.5. This is due to missing nonc | Jun 3, 2023 | 6.1 | 22 | NO | NO |
CVE-2023-2301MEDIUM The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to missing nonce validation | Jun 3, 2023 | 6.1 | 22 | NO | NO |
CVE-2023-2405MEDIUM The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validati | Jun 3, 2023 | 6.5 | 21 | NO | NO |
CVE-2023-2298MEDIUM The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in versions up to, | Jun 3, 2023 | 6.1 | 21 | NO | NO |
CVE-2023-2416MEDIUM The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcita_logout_ca | Jun 3, 2023 | 6.5 | 20 | NO | NO |
CVE-2023-2407MEDIUM The Event Registration Calendar By vcita plugin, versions up to and including 3.10.0, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerab | Jun 3, 2023 | 6.5 | 20 | NO | NO |
CVE-2023-2302MEDIUM The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.4 du | Jun 3, 2023 | 5.4 | 20 | NO | NO |
CVE-2025-67559MEDIUM Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access | Dec 9, 2025 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (34 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vcita.
Media articles that mention a CVE ID that affects a product developed by Vcita — matched by CVE ID, not by vendor name.