Product by WPdevelop

    Booking Calendar

    26 known vulnerabilities in Booking Calendar (WPdevelop), 0 of them actively exploited (CISA KEV).

    Key figures

    26

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Booking Calendar (WPdevelop)
    CriticalCVE-2024-1207

    Booking Calendar <= 9.9 - Unauthenticated SQL Injection

    also in 1 other product

    		9.8
    HighCVE-2022-1463

    Booking Calendar <= 9.1 - PHP Object Injection via Shortcode

    also in 1 other product

    		8.8
    HighCVE-2026-92619

    Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter

    		7.2
    MediumCVE-2017-2150

    WPdevelop Booking Calendar: Path Traversal

    also in 1 other product

    		5.3
    MediumCVE-2026-92561

    Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter

    		6.1
    MediumCVE-2026-93655

    Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter

    		6.1
    HighCVE-2025-14383

    Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check

    		7.5
    HighCVE-2026-59558

    WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability

    		7.1
    MediumCVE-2017-2151

    WPdevelop Booking Calendar: Cross-Site Scripting (XSS)

    also in 1 other product

    		6.1
    MediumCVE-2026-18496

    WPdevelop Booking Calendar: Exposure of Sensitive Information to an Unauthorized Actor

    		5.3
    HighCVE-2026-32358

    WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability

    		7.6
    MediumCVE-2026-74002

    WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability

    		5.3
    MediumCVE-2024-8274

    WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting

    also in 1 other product

    		6.1
    MediumCVE-2024-13323

    WPdevelop Booking Calendar: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-4669

    WPdevelop Booking Calendar: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-14146

    Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure

    		5.3
    LowCVE-2026-39601

    WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability

    		3.7
    MediumCVE-2025-12804

    WPdevelop Booking Calendar: Cross-site Scripting

    		6.4
    MediumCVE-2025-64381

    WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability

    		6.5
    MediumCVE-2024-13821

    WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation

    also in 1 other product

    		5.3
    MediumCVE-2026-1431

    Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure

    		5.3
    MediumCVE-2025-9346

    Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    		6.4
    MediumCVE-2024-6930

    WPdevelop Booking Calendar: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-14982

    Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure

    		4.3
    MediumCVE-2026-2230

    WPdevelop Booking Calendar: Authorization Bypass Through User-Controlled Key

    		4.3

    All vulnerabilities in search

    All products by WPdevelop