What’s Vulnerable › Products
wpdevart Booking calendar, Appointment Booking System vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.
Check whether your wpdevart Booking calendar, Appointment Booking System version is affected
Latest wpdevart Booking calendar, Appointment Booking System vulnerabilities
- CVE-2026-14334 — Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload (CVSS 8.8)
- CVE-2026-73395 — WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- CVE-2026-8840 — Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action (CVSS 5.3)
- CVE-2026-57778 — WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-15289 — Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id' (CVSS 5.9)
- CVE-2026-25435 — WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2025-67574 — WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2024-12077 — Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' (CVSS 6.1)
- CVE-2024-10856 — Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection (CVSS 6.5)
- CVE-2023-24407 — WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-9504 — Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2)
- CVE-2023-24373 — WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability (CVSS 9.8)
- CVE-2022-47428 — WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection (CVSS 9.8)
- CVE-2022-47438 — WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2023-24388 — WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- CVE-2022-3982 — Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- CVE-2018-10363 — (CVSS 7.5)