What’s Vulnerable › Products

codepeople Appointment Booking Calendar vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your codepeople Appointment Booking Calendar version is affected

Latest codepeople Appointment Booking Calendar vulnerabilities

• CVE-2026-111727 — Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter (CVSS 6.4)
• CVE-2026-76586 — BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation (CVSS 7.5)
• CVE-2026-12378 — BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection (CVSS 8.1)
• CVE-2026-12113 — Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure (CVSS 4.3)
• CVE-2026-12111 — Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter (CVSS 4.3)
• CVE-2025-13317 — Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter (CVSS 5.3)
• CVE-2025-64261 — WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2025-46247 — WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability (CVSS 9.8)
• CVE-2025-46241 — WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability (CVSS 8.8)
• CVE-2024-12274 — BookingPress < 1.1.23 - Unauthenticated Export File Download (CVSS 7.5)
• CVE-2024-0856 — Booking Calendar < 1.3.83 - CSRF appointment scheduling (CVSS 8.8)
• CVE-2022-43482 — WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability (CVSS 8.8)
• CVE-2020-9372 — (CVSS 7.8)
• CVE-2020-9371 — (CVSS 4.8)
• CVE-2016-10916 — (CVSS 9.8)
• CVE-2019-14791 — (CVSS 6.1)
• CVE-2015-7320 — (CVSS 4.3)
• CVE-2015-7319 — (CVSS 7.5)