Booking Calendar Vulnerabilities

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.36. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.2.36

Fix:

No patched version reported

Disclosed:

Aug 18, 2026

CVE-2026-73395 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.36. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...

CVSS:

7.2

Affected:

up to 3.2.36

Fix:

No patched version reported

Disclosed:

Aug 17, 2026

CVE-2026-14334 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrar...

CVSS:

5.3

Affected:

up to 3.2.36

Fix:

No patched version reported

Disclosed:

Aug 14, 2026

CVE-2026-8840 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.2.36. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.2.36

Fix:

No patched version reported

Disclosed:

Jul 2, 2026

CVE-2026-57778 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...

CVSS:

7.2

Affected:

up to 3.2.36

Fix:

No patched version reported

Disclosed:

Mar 18, 2026

CVE-2026-25435 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.2.30. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.2.30

Fixed in:

3.2.31

Disclosed:

Dec 15, 2025

CVE-2025-67574 on NVD →

[en] Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.

Affected:

up to 3.2.30

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-67574 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevart_id’ parameter in all versions up to, and including, 3.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...

CVSS:

5.9

Affected:

up to 3.2.17

Fixed in:

3.2.18

Disclosed:

Jul 1, 2025

CVE-2026-15289 on NVD →

[en] The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthen...

Affected:

up to 3.2.20

Fixed in:

3.2.20

Disclosed:

Jan 7, 2025

CVE-2024-12077 on NVD →

The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVSS:

6.1

Affected:

up to 3.2.19

Fixed in:

3.2.20

Disclosed:

Jan 6, 2025

CVE-2024-12077 on NVD →

[en] The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query...

Affected:

up to 3.2.20

Fixed in:

3.2.20

Disclosed:

Dec 24, 2024

CVE-2024-10856 on NVD →

The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The...

CVSS:

6.5

Affected:

up to 3.2.19

Fixed in:

3.2.20

Disclosed:

Dec 23, 2024

CVE-2024-10856 on NVD →

[en] Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Dec 9, 2024

CVE-2023-24407 on NVD →

[en] The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

Affected:

up to 3.2.16

Fixed in:

3.2.16

Disclosed:

Nov 26, 2024

CVE-2024-9504 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web sc...

CVSS:

7.2

Affected:

up to 3.2.15

Fixed in:

3.2.16

Disclosed:

Nov 25, 2024

CVE-2024-9504 on NVD →

[en] External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Jun 3, 2024

CVE-2023-24373 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with Editor-level access and above, to perform an unauthorized actio...

CVSS:

4.1

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Jan 27, 2024

CVE-2023-24407 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.7.

Affected:

up to 3.2.8

Fixed in:

3.2.8

Disclosed:

Nov 6, 2023

CVE-2022-47428 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to SQL Injection via the '$email_address' variable in all versions up to, and including, 3.2.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it pos...

CVSS:

7.2

Affected:

up to 3.2.11

Fixed in:

3.2.12

Disclosed:

Oct 29, 2023

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to SQL Injection via the '$email_address' variable in all versions up to, and including, 3.2.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it pos...

Affected:

up to 3.2.12

Fixed in:

3.2.12

Disclosed:

Oct 29, 2023

The Booking calendar plugin for WordPress is vulnerable to SQL Injection via the search functionality on multiple administrative pages in versions up to, and including, 3.2.8 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVSS:

7.2

Affected:

up to 3.2.9

Fixed in:

3.2.9

Disclosed:

Sep 12, 2023

The Booking calendar plugin for WordPress is vulnerable to SQL Injection via the search functionality on multiple administrative pages in versions up to, and including, 3.2.8 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible...

Affected:

up to 3.2.9

Fixed in:

3.2.9

Disclosed:

Sep 12, 2023

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to generic SQL Injection via the multiple *_selected functions in versions up to, and including, 3.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVSS:

7.2

Affected:

up to 3.2.6

Fixed in:

3.2.7

Disclosed:

Apr 19, 2023

CVE-2022-47428 on NVD →

[en] Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions.

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Mar 29, 2023

CVE-2022-47438 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Feb 17, 2023

CVE-2023-24388 on NVD →

The Booking calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary w...

CVSS:

5.5

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Jan 27, 2023

CVE-2022-47438 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to a bypass in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to bypass controls. It is unclear from the original source of this vulnerability what the actual impact is.

CVSS:

5.3

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Jan 27, 2023

CVE-2023-24373 on NVD →

The Booking calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation when creating, editing, duplicating and deleting bookings. This makes it possible for unauthenticated attackers to manipulate bookings using...

CVSS:

4.3

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Jan 27, 2023

CVE-2023-24388 on NVD →

[en] The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE

Affected:

up to 3.2.2

Fixed in:

3.2.2

Disclosed:

Dec 12, 2022

CVE-2022-3982 on NVD →

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the save_reserv function in versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites ser...

CVSS:

9.8

Affected:

up to 3.2.1

Fixed in:

3.2.2

Disclosed:

Nov 21, 2022

CVE-2022-3982 on NVD →

[en] An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.

Affected:

up to 2.2.3

Fixed in:

2.2.3

Disclosed:

Jun 13, 2018

CVE-2018-10363 on NVD →

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin in versions up to, and including, 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.

CVSS:

7.5

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

Jun 7, 2018

CVE-2018-10363 on NVD →

Multiple Cross-Site Scripting (XSS) vulnerabilities found by d4wner in WordPress Booking calendar plugin (versions <=2.1.7).

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 22, 2018

[en] An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 13, 2018

CVE-2018-5673 on NVD →

[en] An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 13, 2018

CVE-2018-5672 on NVD →

[en] An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 13, 2018

CVE-2018-5671 on NVD →

[en] An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 13, 2018

CVE-2018-5670 on NVD →

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.

CVSS:

8.8

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 12, 2018

CVE-2018-5673 on NVD →

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.

CVSS:

5.5

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 11, 2018

CVE-2018-5671 on NVD →

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.

CVSS:

5.5

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 11, 2018

CVE-2018-5672 on NVD →

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.

CVSS:

5.5

Affected:

up to 2.1.8

Fixed in:

2.1.8

Disclosed:

Jan 11, 2018

CVE-2018-5670 on NVD →

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Affected:

up to 3.2.12

Fixed in:

3.2.12

The Booking calendar plugin for WordPress is vulnerable to SQL Injection via the search functionality on multiple administrative pages in versions up to, and including, 3.2.8 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible...

Affected:

up to 3.2.9

Fixed in:

3.2.9

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the &lsquo;wpdevart_id&rsquo; parameter in all versions up to, and including, 3.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

Affected:

up to 3.2.18

Fixed in:

3.2.18