Online Booking & Scheduling Calendar for WordPress by vcita vulnerabilities

The Online Booking & Scheduling Calendar for WordPress by vcita plugin in versions up to and including 4.6.0 contains an unauthenticated Broken Access Control vulnerability. This allows access to functions or data that should be protected.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin up to version 4.6.0 is vulnerable to stored cross-site scripting via the business_id parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin, in versions up to and including 4.5.5, contains a Missing Authorization vulnerability. Incorrectly configured access control security levels can be exploited by an attacker to perform unauthorized actions.

The Online Booking & Scheduling Calendar for WordPress by vcita plugin (meeting-scheduler-by-vcita) in versions up to and including 4.5.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw allows an attacker to force a logged-in user to perform unwanted actions.