Product by WpDevArt
Booking Calendar, Appointment Booking System
15 known vulnerabilities in Booking Calendar, Appointment Booking System (WpDevArt), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-3982 | Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload | 9.8 | |
| Medium | CVE-2026-8840 | Missing Authorization (CVE-2026-8840) | 5.3 | |
| Medium | CVE-2026-73395 | Authorization Bypass Through User-Controlled Key (CVE-2026-73395) | 6.5 | |
| Medium | CVE-2026-15289 | SQL Injection (CVE-2026-15289) | 5.9 | |
| Critical | CVE-2022-47428 | WpDevArt Booking Calendar: SQL Injection | 6.7 | |
| High | CVE-2024-9504 | Unrestricted Upload of File with Dangerous Type (CVE-2024-9504) | 7.2 | |
| Medium | CVE-2024-10856 | Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection | 6.5 | |
| High | CVE-2026-25435 | Cross-site Scripting (CVE-2026-25435) | 7.1 | |
| Medium | CVE-2026-57778 | Missing Authorization (CVE-2026-57778) | 5.3 | |
| High | CVE-2023-24407 | WpDevArt Booking Calendar: Missing Authorization | 5.0 | |
| Medium | CVE-2024-12077 | WpDevArt Booking Calendar Pro WpDevArt: Cross-site Scripting | 6.1 | |
| Medium | CVE-2025-67574 | Missing Authorization (CVE-2025-67574) | 5.3 | |
| Medium | CVE-2022-47438 | WpDevArt Booking Calendar: Cross-site Scripting | 5.9 | |
| Medium | CVE-2023-24388 | WpDevArt Booking Calendar: Cross-Site Request Forgery (CSRF) | 5.4 | |
| Critical | CVE-2023-24373 | WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability | 3.7 |