# wpdevart Booking calendar, Appointment Booking System.

Every CVE that names wpdevart Booking calendar, Appointment Booking System among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-73395.md)
  `CVE-2026-73395` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action](https://agentprime.io/advisories/CVE-2026-8840.md)
  `CVE-2026-8840` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Broken access control
- [WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-57778.md)
  `CVE-2026-57778` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Broken access control
- [Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'](https://agentprime.io/advisories/CVE-2026-15289.md)
  `CVE-2026-15289` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 5.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: SQL injection
- [WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-25435.md)
  `CVE-2026-25435` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 7.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2025-67574.md)
  `CVE-2025-67574` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 5.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Broken access control
- [Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'](https://agentprime.io/advisories/CVE-2024-12077.md)
  `CVE-2024-12077` · CVE record: wpdevart Booking calendar, Appointment Booking System and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 7 Jan 2025 · Tags: Cross-site scripting (XSS)
- [Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection](https://agentprime.io/advisories/CVE-2024-10856.md)
  `CVE-2024-10856` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 6.5 Medium · Not analysed yet · Published 24 Dec 2024 · Tags: SQL injection
- [WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2023-24407.md)
  `CVE-2023-24407` · CVE record: WpDevArt Booking calendar, Appointment Booking System · CVSS 5.0 Medium · Not analysed yet · Published 9 Dec 2024 · Tags: Broken access control
- [Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload](https://agentprime.io/advisories/CVE-2024-9504.md)
  `CVE-2024-9504` · CVE record: wpdevart Booking calendar, Appointment Booking System · CVSS 7.2 High · Not analysed yet · Published 26 Nov 2024 · Tags: Unrestricted file upload
- [WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability](https://agentprime.io/advisories/CVE-2023-24373.md)
  `CVE-2023-24373` · CVE record: WpDevArt Booking calendar, Appointment Booking System · CVSS 3.7 Low · Not analysed yet · Published 3 Jun 2024 · Tags: CWE-472
- [WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection](https://agentprime.io/advisories/CVE-2022-47428.md)
  `CVE-2022-47428` · CVE record: WpDevArt Booking calendar, Appointment Booking System · CVSS 6.7 Medium · Not analysed yet · Published 6 Nov 2023 · Tags: SQL injection
- [WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2022-47438.md)
  `CVE-2022-47438` · CVE record: WpDevArt Booking calendar, Appointment Booking System · CVSS 5.9 Medium · Not analysed yet · Published 29 Mar 2023 · Tags: Cross-site scripting (XSS)
- [WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)](https://agentprime.io/advisories/CVE-2023-24388.md)
  `CVE-2023-24388` · CVE record: WpDevArt Booking calendar, Appointment Booking System · CVSS 5.4 Medium · Not analysed yet · Published 17 Feb 2023 · Tags: Cross-site request forgery (CSRF)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=wpdevart-booking-calendar-appointment-booking-system>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/wpdevart-booking-calendar-appointment-booking-system/>. Everything for agents: <https://agentprime.io/llms.txt>.