Booking Calendar
Wpdevelop · 24 CVEs
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
Oct 2, 2026
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Sep 22, 2026
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
Sep 18, 2026
Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
Sep 18, 2026
WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Sep 17, 2026
WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability
Jul 27, 2026
WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability
Mar 13, 2026
Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings…
Feb 18, 2026
Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
Jan 31, 2026
Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure
Jan 16, 2026
Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure
Jan 9, 2026
Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check
Dec 15, 2025
Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode
Dec 5, 2025
WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability
Nov 13, 2025
Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Aug 28, 2025
Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
May 17, 2025
WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
Feb 12, 2025
WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Oct 4, 2024
WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting
Aug 30, 2024
WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode
Jul 24, 2024
Booking Calendar <= 9.9 - Unauthenticated SQL Injection
Feb 8, 2024
Booking Calendar <= 9.1 - PHP Object Injection via Shortcode
May 10, 2022
Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitr…
Apr 28, 2017
Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary…
Apr 28, 2017
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-39601 | WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability | LOW | 0.16% | Oct 2, 2026 |
| CVE-2026-93655 | Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter | MEDIUM | 0.37% | Sep 22, 2026 |
| CVE-2026-92561 | Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter | MEDIUM | 0.41% | Sep 18, 2026 |
| CVE-2026-92619 | Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter | HIGH | 0.66% | Sep 18, 2026 |
| CVE-2026-74002 | WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability | MEDIUM | 0.29% | Sep 17, 2026 |
| CVE-2026-59558 | WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability | HIGH | 0.25% | Jul 27, 2026 |
| CVE-2026-32358 | WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability | HIGH | 0.38% | Mar 13, 2026 |
| CVE-2026-2230 | Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification | MEDIUM | 0.20% | Feb 18, 2026 |
| CVE-2026-1431 | Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure | MEDIUM | 0.30% | Jan 31, 2026 |
| CVE-2025-14982 | Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure | MEDIUM | 0.38% | Jan 16, 2026 |
| CVE-2025-14146 | Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure | MEDIUM | 0.38% | Jan 9, 2026 |
| CVE-2025-14383 | Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check | HIGH | 0.42% | Dec 15, 2025 |
| CVE-2025-12804 | Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode | MEDIUM | 0.18% | Dec 5, 2025 |
| CVE-2025-64381 | WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 0.15% | Nov 13, 2025 |
| CVE-2025-9346 | Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | MEDIUM | 0.20% | Aug 28, 2025 |
| CVE-2025-4669 | Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode | MEDIUM | 0.34% | May 17, 2025 |
| CVE-2024-13821 | WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation | MEDIUM | 0.41% | Feb 12, 2025 |
| CVE-2024-9306 | WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting | MEDIUM | 0.32% | Oct 4, 2024 |
| CVE-2024-8274 | WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting | MEDIUM | 0.50% | Aug 30, 2024 |
| CVE-2024-6930 | WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode | MEDIUM | 0.32% | Jul 24, 2024 |
| CVE-2024-1207 | Booking Calendar <= 9.9 - Unauthenticated SQL Injection | CRITICAL | 3.15% | Feb 8, 2024 |
| CVE-2022-1463 | Booking Calendar <= 9.1 - PHP Object Injection via Shortcode | HIGH | 1.72% | May 10, 2022 |
| CVE-2017-2151 | Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified v… | MEDIUM | 0.85% | Apr 28, 2017 |
| CVE-2017-2150 | Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_cha… | MEDIUM | 2.40% | Apr 28, 2017 |
Showing 1 to 24 of 24 CVEs