WordPress security by component
Booked
Plugin description
Booked is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Jul 02, 2026; the highest CVE/CNA score is 7.1.
Plugin slug:
bookedLatest vulnerability
CVE-2026-57747: Booked: Cross-site request forgery
Booked is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is n/a through 3.0.0.
| Safe version |
|
||
|---|---|---|---|
| Jul 02, 2026 |
CVE-2026-57747
Booked: Cross-site request forgery
Booked is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is n/a through 3.0.0.
|
> 3.0.0 |
CVE6.5
NVDPending
|
| Jul 02, 2026 |
CVE-2026-57746
Booked: A security weakness
Booked is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.0.0.
|
> 3.0.0 |
CVE7.1
NVDPending
|
| Feb 20, 2026 |
CVE-2026-22341
Booked: Privilege escalation or authentication bypass
Booked is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE6.7
NVDPending
|
| Dec 28, 2023 |
CVE-2022-36399
Booked - Appointment Booking for WordPress | Calendars: A security weakness
Booked - Appointment Booking for WordPress | Calendars is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD7.5
|