WordPress Plugin Vulnerabilities

Online Booking & Scheduling Calendar for WordPress by vcita < 4.6.0 - Authenticated (Subscriber+) Sensitive Information Exposure

Description

The plugin is vulnerable to Sensitive Information Exposure. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
meeting-scheduler-by-vcita
Fixed in 4.6.0

References

CVE
CVE-2025-32238
URL
https://patchstack.com/database/wordpress/plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-2-sensitive-data-exposure-vulnerability

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
ab80d8ba-d03e-411b-b7ff-808d2e406c51

Timeline

Publicly Published
2025-04-04 (about 1 year ago)
Added
2025-04-10 (about 1 year ago)
Last Updated
2025-11-24 (about 9 months ago)

Other

Published
Title
Published
2025-12-12
Title
Export WP Page to Static HTML & PDF < 5.0.0 - Unauthenticated Cookie Exposure via Log File
Published
2025-03-21
Title
GiveWP – Donation Plugin and Fundraising Platform < 3.22.2 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2026-07-08
Title
PDF Builder for WooCommerce. Create invoices,packing slips and more < 2.0.9 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2025-10-14
Title
External Login <= 1.11.2 - Authenticated (Subscriber+) Sensitive Data Exposure via Test Connection
Published
2025-06-13
Title
Sharable Password Protected Posts < 1.1.1 - Unauthenticated Password Protect Post Access