Plugin icon

Bookit — Booking & Appointment Calendar

bookit

Vulnerabilities:

9

Last Updated:

April 9, 2026

Active Installs:

5000

Published
Title
Fixed in
CVSS
Published
2026-04-22
Title
Bookit — Booking & Appointment Calendar < 2.5.4.1 - Missing Authorization
Fixed in
Fixed in 2.5.4.1
CVSS
5.3 (medium)
Published
2025-11-15
Title
Bookit < 2.5.1 – Unauthenticated Settings Update
Fixed in
Fixed in 2.5.1
CVSS
5.3 (medium)
Published
2025-11-11
Title
Booking Calendar | Appointment Booking | Bookit < 2.5.1 - Missing Authorization to Unauthenticated Stripe Connection
Fixed in
Fixed in 2.5.1
CVSS
7.5 (high)
Published
2024-01-31
Title
BookIt <= 2.4.0 - Price Bypass
Fixed in
Fixed in 2.4.1
CVSS
4.9 (medium)
Published
2023-12-21
Title
BookIt < 2.4.4 - Authenticated(Administrator+) SQL Injection
Fixed in
Fixed in 2.4.4
CVSS
6.6 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.3.9
CVSS
6.1 (medium)
Published
2023-06-20
Title
BookIt < 2.3.8 - Authentication Bypass
Fixed in
Fixed in 2.3.8
CVSS
9.8 (critical)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 2.2.9
CVSS
4.3 (medium)
Published
2021-06-30
Title
Booking Calendar | Appointment Booking | BookIt < 2.1.6 - Authorised AJAX Calls
Fixed in
Fixed in 2.1.6
CVSS
4.3 (medium)