Online Booking & Scheduling Calendar by vcita

Changelog

4.6.6

• Fixed: Creating a new vcita account from «Let’s get started» left the plugin disconnected – the account was created but the plugin was never told about it, so you still saw the connect prompt. Sign-up now carries the connection details with it, so the plugin connects as soon as you finish creating your account.

4.6.5

• Fixed: If your browser blocked the vcita sign-in pop-up, connecting left you on a blank «Authentication OK» page. Your account was connected, but you had to navigate back by hand. You are now returned to the plugin automatically.

4.6.4

• Fixed: «Let’s get started» and «Connect» did nothing on a newly installed site, leaving no way to connect a vcita account. The sign-in window is now opened as soon as you click, and if your browser blocks pop-ups the plugin sends you to vcita in the current tab instead of failing silently.
• Fixed: After connecting your vcita account the page now updates on its own. Previously it kept showing you as disconnected until you refreshed by hand, even though the connection had succeeded.

4.6.3

• Privacy: Removed all third-party analytics from the plugin. Mixpanel and Hotjar are no longer loaded, and no usage data or account details are sent to any third party.
• Fixed: The mobile preview on the «Add to Site» screen now displays your site correctly. It previously pointed at the wrong address on any site using a non-standard port or installed in a subdirectory, so the preview appeared empty.

4.6.2

• Fixed: Upgrading the plugin no longer disconnects your vcita account. Previously, every version update cleared the stored connection and prompted you to reconnect before the scheduling widget would work again.
• Security & standards: Full WordPress coding standards and security pass across the plugin, resolving all issues reported by the Plugin Check tool – output escaping, input sanitization and nonce verification, direct file access protection, use of the WordPress HTTP API in place of cURL, and removal of unused bundled files.

4.6.1

• Security: Fixed CVE-2026-14433 – Unauthenticated stored XSS via the business_id parameter in the /wp-json/vcita-wordpress/v1/actions/connect REST route. The ownership guard now fails closed instead of silently passing on a malformed or unreachable proxy response, business_id is validated against the vcita uid format before being stored, and all output sites now escape the value with esc_js()/esc_html(). The ownership check’s remote lookup now uses wp_remote_get() instead of file_get_contents().

4.6.0

• Security: Fixed CSRF vulnerabilities in admin AJAX actions. Added nonce verification to logout, dismiss, and plugin deactivation functions.
• Security: Fixed CVE-2025-32238 – Sensitive information exposure in authentication check
• Security: Fixed arbitrary file upload vulnerability that could lead to remote code execution
• Security: Fixed XSS vulnerabilities in widget title, text, and button fields
• Security: Improved file upload validation with WordPress built-in security functions
• Security: Added proper authorization checks to all sensitive AJAX operations
• Security: Added proper output escaping to prevent XSS attacks

4.5.5

• Security Update

4.5.3

• verification for wordpress 6.7.2

4.5.2

• security improvement

4.5

• security update and performance improvements

4.4.5

• file naming change

4.4.4

• scurity update

4.4.3

• scurity update

4.4.2

• bug fix

4.4.1

• bug fixs
• security improvements

4.4.0

• Tested and updated for compatibility with WordPress 6.4

4.3.5

• WordPress version update
• Login in new tab for all browsers

4.3.3

• security improvements

4.3.2

• bug fix

4.3.1

• security improvements

4.3.0

• security improvements

4.2.10

• Bug fixes

4.2.9

• UX improvements
• Bug fixes

4.2.7

• UX improvements
• Bug fixes

4.2.6

• Bug fixes

4.2.5

• Localising the plugin

4.2.4

• Help Wizard
• Easy onboarding

4.2.3

• UI improvements

4.2.2

• bug fixes

4.2.1

• bug fixes

4.2

• bug fixes

4.1.5

• Adding the ability to deactivate other vcita plugins

4.1.4

• bug fixes

4.1.3

• Text corrections

4.1.2

• Expediting plugin loading

Version 4.1.1

• Bug fixes

4.1

• Brand new look & feel
• Advanced customisation options for scheduling widget
• Bug fixes

3.16.1

• Updated to latest WordPress version

3.16

• Fixed some minor bugs
• Updated to latest WordPress version