Vulnerabilities > Vcita > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-07-22 | CVE-2024-37262 | Cross-site Scripting vulnerability in Vcita Online Booking & Scheduling Calendar for Wordpress BY Vcita Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.2. | 6.1 |
| 2024-06-22 | CVE-2024-5791 | Cross-site Scripting vulnerability in Vcita Online Booking & Scheduling Calendar for Wordpress BY Vcita The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input sanitization and output escaping. | 6.1 |
| 2024-06-21 | CVE-2024-35761 | Cross-site Scripting vulnerability in Vcita Online Booking & Scheduling Calendar for Wordpress BY Vcita Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.0. | 5.4 |
| 2024-06-21 | CVE-2024-5859 | Cross-site Scripting vulnerability in Vcita Online Booking & Scheduling Calendar for Wordpress BY Vcita The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘d’ parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. | 6.1 |
| 2023-09-04 | CVE-2023-39992 | Cross-site Scripting vulnerability in Vcita Online Booking & Scheduling Calendar for Wordpress BY Vcita Unauth. | 6.1 |
| 2023-06-09 | CVE-2023-2414 | Missing Authorization vulnerability in Vcita Online Booking & Scheduling Calendar The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. | 4.3 |
| 2023-06-03 | CVE-2023-2298 | Cross-site Scripting vulnerability in Vcita Online Booking & Scheduling Calendar for Wordpress 4.2.10 The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. | 6.1 |
| 2023-06-03 | CVE-2023-2299 | Missing Authorization vulnerability in Vcita Online Booking & Scheduling Calendar for Wordpress 4.2.10 The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10 due to a missing capability check on the processAction function. | 5.3 |
| 2023-06-03 | CVE-2023-2300 | Cross-site Scripting vulnerability in Vcita Contact Form Builder BY Vcita The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. | 5.4 |
| 2023-06-03 | CVE-2023-2301 | Cross-Site Request Forgery (CSRF) vulnerability in Vcita Contact Form Builder BY Vcita The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.1. | 6.1 |