CVE-2025-32238 - CVE House
Back to Database
Status published Medium CVE-2025-32238

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability

Vulnerability Description

Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32238

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Joshua Chan | Patchstack Bug Bounty Program

References

More from vcita

View All →
CVE-2025-67559
WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability
Medium 5.4
CVE-2025-67472
WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability
Medium 4.3
CVE-2025-5240
CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter
Medium 6.4
CVE-2025-54677
WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability
Critical 9.1
CVE-2025-54676
WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability
Medium 6.5

Affected Vendor

Affected Software

Online Booking & Scheduling Calendar for WordPress by vcita
Vulnerable Versions:
0

Timeline

Official Publish: April 4th, 2025
Last Modified: May 12th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-209

MITRE ATT&CK TTPs

T1592 Gather Victim Host Information
Reconnaissance
T1083 File and Directory Discovery
Discovery
T1552 Unsecured Credentials
Credential Access
T1212 Exploitation for Defense Evasion
Defense Evasion
T1005 Data from Local System
Collection