What’s Vulnerable › Products
murgroland WP Booking System – Booking Calendar vulnerabilities
11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.
Check whether your murgroland WP Booking System – Booking Calendar version is affected
Latest murgroland WP Booking System – Booking Calendar vulnerabilities
- CVE-2026-116557 — WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action (CVSS 9.1)
- CVE-2026-109369 — WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse (CVSS 6.8)
- CVE-2026-109368 — WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action (CVSS 6.5)
- CVE-2026-108123 — WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action (CVSS 7.5)
- CVE-2026-111178 — WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9)
- CVE-2026-107712 — WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter (CVSS 6.5)
- CVE-2024-8797 — WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2023-24402 — WordPress WP Booking System Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)
- CVE-2021-25061 — WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS) (CVSS 5.4)
- CVE-2019-12239 — (CVSS 7.2)
- CVE-2017-2168 — (CVSS 6.1)