Wp Simple Booking Calendar Vulnerabilities

The WP Simple Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.0.13

Fixed in:

2.0.14

Disclosed:

Apr 16, 2025

CVE-2025-39541 on NVD →

[en] The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject arbitrary web s...

Affected:

up to 2.0.11

Fixed in:

2.0.11

Disclosed:

Sep 13, 2024

CVE-2024-8663 on NVD →

The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVSS:

6.1

Affected:

up to 2.0.10

Fixed in:

2.0.11

Disclosed:

Sep 12, 2024

CVE-2024-8663 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a through 2.0.8.4.

Affected:

up to 2.0.8.5

Fixed in:

2.0.8.5

Disclosed:

Mar 15, 2024

CVE-2023-51525 on NVD →

The WP Simple Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.8.4. This is due to missing or incorrect nonce validation on the wpsbc_refresh_calendar_editor function. This makes it possible for unauthenticated attackers to refresh the calendar...

CVSS:

4.3

Affected:

up to 2.0.8.4

Fixed in:

2.0.8.5

Disclosed:

Dec 27, 2023

CVE-2023-51525 on NVD →

[en] The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Sep 13, 2021

CVE-2021-24726 on NVD →

The WP Simple Booking Calendar WordPress plugin before 2.0.7 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue

CVSS:

8.8

Affected:

up to 2.0.6

Fixed in:

2.0.7

Disclosed:

Aug 6, 2021

CVE-2021-24726 on NVD →

Affected:

up to 2.0.14

Fixed in:

2.0.14

CVE-2025-39541 on NVD →