Advisories · Technology

wpdevelop Booking Calendar.

Every CVE that names wpdevelop Booking Calendar among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-18496 CVE record

CVSS 5.3 Medium

Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
- wpdevelop Booking Calendar
- Information disclosure
Not analysed yet 10 Oct 2026
CVE-2026-39601 CVE record

CVSS 3.7 Low

WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
- WPdevelop Booking Calendar
- Race condition
Not analysed yet 2 Oct 2026
CVE-2026-93655 CVE record

CVSS 6.1 Medium

Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 22 Sept 2026
CVE-2026-92561 CVE record

CVSS 6.1 Medium

Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 18 Sept 2026
CVE-2026-92619 CVE record

CVSS 7.2 High

Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
- wpdevelop Booking Calendar
- Privilege escalation
Not analysed yet 18 Sept 2026
CVE-2026-74002 CVE record

CVSS 5.3 Medium

WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
- wpdevelop Booking Calendar
- Broken access control
Not analysed yet 17 Sept 2026
CVE-2026-59558 CVE record

CVSS 7.1 High

WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 27 Jul 2026
CVE-2026-32358 CVE record

CVSS 7.6 High

WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability
- wpdevelop Booking Calendar
- SQL injection
Not analysed yet 13 Mar 2026
CVE-2026-2230 CVE record

CVSS 4.3 Medium

Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification
- wpdevelop Booking Calendar
- Broken access control
Not analysed yet 18 Feb 2026
CVE-2026-1431 CVE record

CVSS 5.3 Medium

Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
- wpdevelop Booking Calendar
- Broken access control
Not analysed yet 31 Jan 2026
CVE-2025-14982 CVE record

CVSS 4.3 Medium

Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure
- wpdevelop Booking Calendar
- Broken access control
Not analysed yet 16 Jan 2026
CVE-2025-14146 CVE record

CVSS 5.3 Medium

Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure
- wpdevelop Booking Calendar
- Broken access control
Not analysed yet 9 Jan 2026
CVE-2025-14383 CVE record

CVSS 7.5 High

Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check
- wpdevelop Booking Calendar
- SQL injection
Not analysed yet 15 Dec 2025
CVE-2025-12804 CVE record

CVSS 6.4 Medium

Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 5 Dec 2025
CVE-2025-64381 CVE record

CVSS 6.5 Medium

WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 13 Nov 2025
CVE-2025-9346 CVE record

CVSS 6.4 Medium

Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 28 Aug 2025
CVE-2025-4669 CVE record

CVSS 6.4 Medium

Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 17 May 2025
CVE-2024-13821 CVE record

CVSS 5.3 Medium

WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
- wpdevelop Booking Calendar
- Broken access control
Not analysed yet 12 Feb 2025
CVE-2024-13323 CVE record

CVSS 6.4 Medium

Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 14 Jan 2025
CVE-2024-9306 CVE record

CVSS 4.4 Medium

WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2024
CVE-2024-8274 CVE record

CVSS 6.1 Medium

WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 30 Aug 2024
CVE-2024-6930 CVE record

CVSS 6.4 Medium

WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
Not analysed yet 24 Jul 2024
CVE-2024-1207 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Booking Calendar <= 9.9 - Unauthenticated SQL Injection
- wpdevelop Booking Calendar
- SQL injection
Not analysed yet 8 Feb 2024
CVE-2022-1463 CVE record

CVSS 8.8 High

Booking Calendar <= 9.1 - PHP Object Injection via Shortcode
- wpdevelop Booking Calendar
- Insecure deserialization
Not analysed yet 10 May 2022
CVE-2017-2151 CVE record

wpdevelop Booking Calendar: Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows…
- wpdevelop Booking Calendar
Not analysed yet 28 Apr 2017
CVE-2017-2150 CVE record

wpdevelop Booking Calendar: Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows…
- wpdevelop Booking Calendar
Not analysed yet 28 Apr 2017