{"id":"CVE-2025-54677","aliases":["EUVD-2025-28563","GHSA-gfhw-6rv5-52pq"],"status":"published","title":"WordPress Online Booking \u0026 Scheduling Calendar for WordPress by vcita Plugin \u003c= 4.5.3 - Arbitrary File Upload Vulnerability","description":"Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking \u0026 Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking \u0026 Scheduling Calendar for WordPress by vcita: from n/a through \u003c= 4.5.3.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00436,"percentile":0.38136,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2025-08-20T08:02:52Z","modified":"2026-06-17T09:40:30Z","exploits":[{"source":"pocgithub","id":"quetuan03/CVE-2025-54677","title":"quetuan03/CVE-2025-54677","date":"2025-10-01","url":"https://github.com/quetuan03/CVE-2025-54677"}],"products":[{"vendor":"vcita","product":"online booking \u0026 scheduling calendar for wordpress by vcita"},{"vendor":"vcita","product":"online_booking_\\\u0026_scheduling_calendar"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-3-arbitrary-file-upload-vulnerability?_s_id=cve","tags":["vdb-entry","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54677"},{"url":"https://patchstack.com/database/wordpress/plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-3-arbitrary-file-upload-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-gfhw-6rv5-52pq"}],"sources":{"cve":[{"id":"CVE-2025-54677","title":"WordPress Online Booking \u0026 Scheduling Calendar for WordPress by vcita Plugin \u003c= 4.5.3 - Arbitrary File Upload Vulnerability","description":"Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking \u0026 Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking \u0026 Scheduling Calendar for WordPress by vcita: from n/a through \u003c= 4.5.3.","status":"published","published":"2025-08-20T08:02:52.476Z","modified":"2026-04-28T16:13:33.894Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:27.603809Z"}],"euvd":[{"id":"EUVD-2025-28563","description":"Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking \u0026 Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking \u0026 Scheduling Calendar for WordPress by vcita: from n/a through \u003c= 4.5.3.","status":"published","published":"2025-08-20T08:02:52Z","modified":"2026-04-28T16:13:33Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:05:35.623334Z"}],"ghsa":[{"id":"GHSA-gfhw-6rv5-52pq","title":"Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking \u0026...","description":"Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking \u0026 Scheduling Calendar for WordPress by vcita allows Using Malicious Files. This issue affects Online Booking \u0026 Scheduling Calendar for WordPress by vcita: from n/a through 4.5.3.","status":"published","published":"2025-08-20T09:30:41Z","modified":"2025-08-20T09:30:42Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:03:20.970493Z"}],"nvd":[{"id":"CVE-2025-54677","description":"Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking \u0026 Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking \u0026 Scheduling Calendar for WordPress by vcita: from n/a through \u003c= 4.5.3.","status":"published","published":"2025-08-20T08:15:49.03Z","modified":"2026-06-17T09:40:30.82Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:11:25.261243Z"}]}}