CVE-2025-67472
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Online Booking & Scheduling Calendar for WordPress by vcita plugin (meeting-scheduler-by-vcita) in versions up to and including 4.5.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw allows an attacker to force a logged-in user to perform unwanted actions.
Risk Assessment
An attacker could trick an administrator or user into performing unintended operations within their session, potentially leading to unauthorized changes to site configuration or data.
Recommendation
Update the Online Booking & Scheduling Calendar for WordPress by vcita plugin to a version later than 4.5.5 as soon as it becomes available.
Other vulnerabilities in Online Booking & Scheduling Calendar for WordPress by vcita
See all- CVE-2026-95513High
The Online Booking & Scheduling Calendar for WordPress by vcita plugin in versions up to and including 4.6.0 contains an unauthenticated Broken Access Control vulnerability. This allows access to functions or data that should be protected.
- CVE-2026-14433High
The Online Booking & Scheduling Calendar for WordPress by vcita plugin up to version 4.6.0 is vulnerable to stored cross-site scripting via the business_id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.
- CVE-2025-67559Medium
The Online Booking & Scheduling Calendar for WordPress by vcita plugin, in versions up to and including 4.5.5, contains a Missing Authorization vulnerability. Incorrectly configured access control security levels can be exploited by an attacker to perform unauthorized actions.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS