WordPress security by component
Booking calendar, Appointment Booking System
Plugin description
Booking calendar, Appointment Booking System is a WordPress component with 26 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
booking-calendarLatest vulnerability
CVE-2026-57778: Booking calendar, Appointment Booking System: A security weakness
Booking calendar, Appointment Booking System is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.2.36.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-57778
Booking calendar, Appointment Booking System: A security weakness
Booking calendar, Appointment Booking System is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.2.36.
|
> 3.2.36 |
CVE5.3
NVDPending
|
| Jul 10, 2026 |
CVE-2026-15289
Booking calendar, Appointment Booking System: SQL injection
Booking calendar, Appointment Booking System is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 3.2.17.
|
> 3.2.17 |
CVE5.9
NVDPending
|
| Mar 25, 2026 |
CVE-2026-25435
Booking calendar, Appointment Booking System: Cross-site scripting
Booking calendar, Appointment Booking System is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.2.36.
|
> 3.2.36 |
CVE7.1
NVDPending
|
| Dec 15, 2025 |
CVE-2025-14383
Booking Calendar: SQL injection
Booking Calendar is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 09, 2025 |
CVE-2025-67574
Booking calendar, Appointment Booking System: A security weakness
Booking calendar, Appointment Booking System is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 05, 2025 |
CVE-2025-12804
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Aug 28, 2025 |
CVE-2025-9346
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exploitation requires at least administrator-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Feb 12, 2025 |
CVE-2024-13821
WP Booking Calendar: A security weakness
WP Booking Calendar is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jan 07, 2025 |
CVE-2024-12077
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| Dec 24, 2024 |
CVE-2024-10856
Booking Calendar: SQL injection
Booking Calendar is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Dec 09, 2024 |
CVE-2023-24407
Booking calendar, Appointment Booking System: A security weakness
Booking calendar, Appointment Booking System is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.0
NVD8.8
|
| Jun 03, 2024 |
CVE-2023-24373
Booking calendar, Appointment Booking System: A security weakness
Booking calendar, Appointment Booking System is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE3.7
NVD9.8
|
| Feb 08, 2024 |
CVE-2024-1207
WP Booking Calendar: SQL injection
WP Booking Calendar is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Nov 06, 2023 |
CVE-2022-47428
Booking calendar, Appointment Booking System: SQL injection
Booking calendar, Appointment Booking System is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE6.7
NVD9.8
|
| Oct 16, 2023 |
CVE-2023-4620
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Mar 29, 2023 |
CVE-2022-47438
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD5.4
|
| Feb 17, 2023 |
CVE-2023-24388
Booking Calendar: Cross-site request forgery
Booking Calendar is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD5.4
|
| Dec 12, 2022 |
CVE-2022-3982
Booking calendar, Appointment Booking System: A security weakness
Booking calendar, Appointment Booking System is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| May 10, 2022 |
CVE-2022-1463
Booking Calendar: Code execution
Booking Calendar is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Jan 03, 2022 |
CVE-2021-25040
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Mar 21, 2019 |
CVE-2018-20556
Booking Calendar: SQL injection
Booking Calendar is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Jun 13, 2018 |
CVE-2018-10363
Booking Calendar: A security weakness
Booking Calendar is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVD7.5
|
| Jan 13, 2018 |
CVE-2018-5673
Booking Calendar: Cross-site request forgery
Booking Calendar is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Jan 13, 2018 |
CVE-2018-5672
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Jan 13, 2018 |
CVE-2018-5671
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Jan 13, 2018 |
CVE-2018-5670
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|