CVE-2026-95513
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Online Booking & Scheduling Calendar for WordPress by vcita plugin in versions up to and including 4.6.0 contains an unauthenticated Broken Access Control vulnerability. This allows access to functions or data that should be protected.
Risk Assessment
An unauthenticated attacker could bypass access control mechanisms and perform unauthorized operations, potentially leading to disclosure or modification of booking data.
Recommendation
Update the Online Booking & Scheduling Calendar for WordPress by vcita plugin to a version newer than 4.6.0.
Other vulnerabilities in Online Booking & Scheduling Calendar for WordPress by vcita
See all- CVE-2026-14433High
The Online Booking & Scheduling Calendar for WordPress by vcita plugin up to version 4.6.0 is vulnerable to stored cross-site scripting via the business_id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.
- CVE-2025-67559Medium
The Online Booking & Scheduling Calendar for WordPress by vcita plugin, in versions up to and including 4.5.5, contains a Missing Authorization vulnerability. Incorrectly configured access control security levels can be exploited by an attacker to perform unauthorized actions.
- CVE-2025-67472Medium
The Online Booking & Scheduling Calendar for WordPress by vcita plugin (meeting-scheduler-by-vcita) in versions up to and including 4.5.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw allows an attacker to force a logged-in user to perform unwanted actions.
Original NVD description (English source)
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS