Plugin icon

Advanced Booking & Appointment System – Webba Booking Calendar

webba-booking-lite

Vulnerabilities:

10

Last Updated:

June 8, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Fixed in
Fixed in 5.1.8
CVSS
7.1 (high)
Published
2025-12-15
Title
Webba Booking < 6.2.2 - Missing Authorization
Fixed in
Fixed in 6.2.2
CVSS
4.3 (medium)
Published
2025-08-14
Title
Webba Booking < 6.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 6.0.6
CVSS
4.4 (medium)
Published
2025-07-16
Title
Webba Booking < 5.1.22 - Missing Authorization
Fixed in
Fixed in 5.1.22
CVSS
5.3 (medium)
Published
2025-07-16
Title
Webba Booking < 5.1.21 - Cross-Site Request Forgery
Fixed in
Fixed in 5.1.21
CVSS
4.3 (medium)
Published
2024-09-23
Title
Appointment & Event Booking Calendar Plugin – Webba Booking < 5.0.50 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update
Fixed in
Fixed in 5.0.50
CVSS
4.3 (medium)
Published
2023-12-26
Title
Webba Booking < 5.0 - Cross-Site Request Forgery
Fixed in
Fixed in 5.0
CVSS
4.3 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.5.31
CVSS
6.1 (medium)
Published
2022-04-15
Title
Webba Booking < 4.2.22 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.2.22
CVSS
3.4 (low)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 4.2.18
CVSS
4.3 (medium)