Medium severity5.4NVD Advisory· Published Dec 6, 2024· Updated Jun 17, 2026
CVE-2024-9872
CVE-2024-9872
Description
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_user_data_callback() function in all versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts and update settings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:vcita:online_booking_\&_scheduling_calendar:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:vcita:online_booking_\&_scheduling_calendar:*:*:*:*:*:wordpress:*:*range: <4.5.2
- (no CPE)range: 0
- Range: <=4.5.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.