WordPress security by component
Booking Calendar
Plugin description
Booking Calendar is a WordPress component with 14 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 7.6.
Plugin slug:
bookingLatest vulnerability
CVE-2026-59558: Booking Calendar public input permits cross-site scripting
Booking Calendar through 11.4.2 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-59558
Booking Calendar public input permits cross-site scripting
Booking Calendar through 11.4.2 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
|
11.4.3 |
CVE7.1
NVDPending
|
| Mar 13, 2026 |
CVE-2026-32358
Booking Calendar: SQL injection
Booking Calendar is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
NVDPending
|
| Feb 18, 2026 |
CVE-2026-2230
Booking Calendar: A security weakness
Booking Calendar is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jan 31, 2026 |
CVE-2026-1431
Booking Calendar: A security weakness
Booking Calendar is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jan 16, 2026 |
CVE-2025-14982
Booking Calendar: Sensitive information exposure
Booking Calendar is affected by sensitive information exposure. Exploitation requires at least subscriber-level access. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jan 09, 2026 |
CVE-2025-14146
Booking Calendar: Sensitive information exposure
Booking Calendar is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Nov 13, 2025 |
CVE-2025-64381
Booking Calendar: Cross-site scripting
Booking Calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| May 17, 2025 |
CVE-2025-4669
WP Booking Calendar: Cross-site scripting
WP Booking Calendar is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Jan 14, 2025 |
CVE-2024-13323
WP Booking Calendar: Cross-site scripting
WP Booking Calendar is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Aug 30, 2024 |
CVE-2024-8274
WP Booking Calendar: Cross-site scripting
WP Booking Calendar is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVDPending
|
| Jul 24, 2024 |
CVE-2024-6930
WP Booking Calendar: Cross-site scripting
WP Booking Calendar is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Mar 26, 2024 |
CVE-2023-23991
Booking Calendar: SQL injection
Booking Calendar is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
NVDPending
|
| Feb 01, 2024 |
CVE-2023-51520
WP Booking Calendar: Cross-site scripting
WP Booking Calendar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Sep 06, 2022 |
CVE-2022-33177
Booking: Cross-site request forgery
Booking is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
NVD4.3
|