Cross-site Scripting in vcita Online Booking & Scheduling Calendar for WordPress
CVE-2025-54676

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Online Booking & Scheduling Calendar For WordPress By Vcita
Vendor
CVE Published:
14 August 2025

What is CVE-2025-54676?

The vcita Online Booking & Scheduling Calendar plugin for WordPress contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This can be exploited to inject malicious scripts that could compromise user data and site integrity, affecting versions from n/a through 4.5.3. It’s crucial for users to regularly update their plugin and implement security best practices to mitigate such risks.

Affected Version(s)

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3

References

https://patchstack.com/database/wordpress/plugin/meeting-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Que Thanh Tuan - Blue Rock (Patchstack Alliance)
.
CVE-2025-54676 : Cross-site Scripting in vcita Online Booking & Scheduling Calendar for WordPress