What’s Vulnerable › Products

codepeople Booking Calendar Contact Form vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your codepeople Booking Calendar Contact Form version is affected

Latest codepeople Booking Calendar Contact Form vulnerabilities

• CVE-2026-6810 — Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover (CVSS 5.3)
• CVE-2025-13318 — Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter (CVSS 5.3)
• CVE-2025-48231 — WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
• CVE-2025-24723 — WordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
• CVE-2023-25037 — WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2023-36384 — WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
• CVE-2022-1463 — Booking Calendar <= 9.1 - PHP Object Injection via Shortcode (CVSS 8.8)
• CVE-2021-25040 — Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting (CVSS 6.1)
• CVE-2018-20556 — (CVSS 8.8)
• CVE-2018-5673 — (CVSS 8.8)
• CVE-2018-5672 — (CVSS 4.8)
• CVE-2018-5671 — (CVSS 4.8)
• CVE-2018-5670 — (CVSS 4.8)
• CVE-2017-2151 — (CVSS 6.1)
• CVE-2017-2150 — (CVSS 5.3)