Wpdevelop Booking Calendar vulnerabilities

CVE-2024-1207 [CRITICAL] CWE-89 CVE-2024-1207: The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_reques The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attacke

CVE-2025-14383 [HIGH] CWE-89 CVE-2025-14383: The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'd The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appen

CVE-2022-1463 [HIGH] CWE-502 CVE-2022-1463: The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflex The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.

CVE-2026-32358 [HIGH] CWE-89 CVE-2026-32358: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.

CVE-2017-2150 [MEDIUM] CWE-22 CVE-2017-2150: Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attacker Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.

CVE-2025-9346 [MEDIUM] CWE-79 CVE-2025-9346: The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will exe

CVE-2025-12804 [MEDIUM] CWE-79 CVE-2025-12804: The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bookingcalendar' shortcode in all versions up to, and including, 10.14.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and ab

CVE-2024-13821 [MEDIUM] CWE-285 CVE-2024-13821: The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Book The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This makes it possible for unauthenticated attackers to manip

CVE-2025-14146 [MEDIUM] CWE-862 CVE-2025-14146: The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action. This is due to the nonce verification being conditionally disabled by default (`booking_is_nonce_at_front_end` option is `'Off'` by default). When the `booking_is_show_p

CVE-2026-1431 [MEDIUM] CWE-862 CVE-2026-1431: The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a miss The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.

CVE-2025-64381 [MEDIUM] CWE-79 CVE-2025-64381: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Calendar booking allows Stored XSS.This issue affects Booking Calendar: from n/a through <= 10.14.7.

CVE-2024-13323 [MEDIUM] CWE-79 CVE-2024-13323: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,

CVE-2025-4669 [MEDIUM] CWE-79 CVE-2025-4669: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to in

CVE-2024-6930 [MEDIUM] CWE-79 CVE-2024-6930: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 't The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib

CVE-2025-14982 [MEDIUM] CWE-862 CVE-2025-14982: The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitiv The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the database, including personally identifiable informati

CVE-2026-2230 [MEDIUM] CWE-639 CVE-2026-2230: The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all v The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by a

CVE-2024-8274 [MEDIUM] CWE-79 CVE-2024-8274: The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via sev The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they

CVE-2017-2151 [MEDIUM] CWE-79 CVE-2017-2151: Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attacke Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2024-9306 [MEDIUM] CWE-79 CVE-2024-9306: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages th