What’s Vulnerable › Products

wpdevelop Booking Calendar vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your wpdevelop Booking Calendar version is affected

Latest wpdevelop Booking Calendar vulnerabilities

• CVE-2026-18496 — Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action (CVSS 5.3)
• CVE-2026-39601 — WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability (CVSS 3.7)
• CVE-2026-93655 — Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter (CVSS 6.1)
• CVE-2026-92619 — Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter (CVSS 7.2)
• CVE-2026-92561 — Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter (CVSS 6.1)
• CVE-2026-74002 — WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-59558 — WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-32358 — WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability (CVSS 7.6)
• CVE-2026-2230 — Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification (CVSS 4.3)
• CVE-2026-1431 — Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure (CVSS 5.3)
• CVE-2025-14982 — Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3)
• CVE-2025-14146 — Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
• CVE-2025-14383 — Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check (CVSS 7.5)
• CVE-2025-12804 — Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode (CVSS 6.4)
• CVE-2025-64381 — WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2025-9346 — Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2025-4669 — Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode (CVSS 5.4)
• CVE-2024-13323 — Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode (CVSS 5.4)
• CVE-2024-10893 — WP Booking Calendar < 10.6.5 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-10027 — WP Booking Calendar < 10.6.3 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-9306 — WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2024-8274 — WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting (CVSS 6.1)