Advisories · Technology

wpdevart Booking calendar, Appointment Booking System.

Every CVE that names wpdevart Booking calendar, Appointment Booking System among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-73395 CVE record

CVSS 6.5 Medium

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
- wpdevart Booking calendar, Appointment Booking System
- Broken access control
Not analysed yet 18 Aug 2026
CVE-2026-8840 CVE record

CVSS 5.3 Medium

Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
- wpdevart Booking calendar, Appointment Booking System
- Broken access control
Not analysed yet 15 Aug 2026
CVE-2026-57778 CVE record

CVSS 5.3 Medium

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability
- wpdevart Booking calendar, Appointment Booking System
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-15289 CVE record

CVSS 5.9 Medium

Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'
- wpdevart Booking calendar, Appointment Booking System
- SQL injection
Not analysed yet 10 Jul 2026
CVE-2026-25435 CVE record

CVSS 7.1 High

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability
- wpdevart Booking calendar, Appointment Booking System
- Cross-site scripting (XSS)
Not analysed yet 25 Mar 2026
CVE-2025-67574 CVE record

CVSS 5.3 Medium

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability
- wpdevart Booking calendar, Appointment Booking System
- Broken access control
Not analysed yet 9 Dec 2025
CVE-2024-12077 CVE record

CVSS 6.1 Medium

Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
- wpdevart Booking calendar, Appointment Booking System
- Booking Calendar Pro WpDevArt
- Cross-site scripting (XSS)
Not analysed yet 7 Jan 2025
CVE-2024-10856 CVE record

CVSS 6.5 Medium

Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection
- wpdevart Booking calendar, Appointment Booking System
- SQL injection
Not analysed yet 24 Dec 2024
CVE-2023-24407 CVE record

CVSS 5.0 Medium

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability
- WpDevArt Booking calendar, Appointment Booking System
- Broken access control
Not analysed yet 9 Dec 2024
CVE-2024-9504 CVE record

CVSS 7.2 High

Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
- wpdevart Booking calendar, Appointment Booking System
- Unrestricted file upload
Not analysed yet 26 Nov 2024
CVE-2023-24373 CVE record

CVSS 3.7 Low

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability
- WpDevArt Booking calendar, Appointment Booking System
- CWE-472
Not analysed yet 3 Jun 2024
CVE-2022-47428 CVE record

CVSS 6.7 Medium

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection
- WpDevArt Booking calendar, Appointment Booking System
- SQL injection
Not analysed yet 6 Nov 2023
CVE-2022-47438 CVE record

CVSS 5.9 Medium

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS)
- WpDevArt Booking calendar, Appointment Booking System
- Cross-site scripting (XSS)
Not analysed yet 29 Mar 2023
CVE-2023-24388 CVE record

CVSS 5.4 Medium

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)
- WpDevArt Booking calendar, Appointment Booking System
- Cross-site request forgery (CSRF)
Not analysed yet 17 Feb 2023