Plugin icon

WP Booking System – Booking Calendar

wp-booking-system

Vulnerabilities:

14

Last Updated:

October 16, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-10-16
Title
WP Booking System < 2.1.0.4 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
Fixed in
Fixed in 2.1.0.4
CVSS
6.8 (medium)
Published
2026-10-16
Title
WP Booking System < 2.1.0.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
Fixed in
Fixed in 2.1.0.4
CVSS
6.5 (medium)
Published
2026-10-16
Title
WP Booking System < 2.1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
Fixed in
Fixed in 2.1.0.4
CVSS
7.5 (high)
Published
2026-10-15
Title
WP Booking System < 2.1.0.2 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Fixed in
Fixed in 2.1.0.2
CVSS
4.9 (medium)
Published
2026-10-12
Title
WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
Fixed in
Fixed in 2.1.0.1
CVSS
8.8 (high)
Published
2026-10-09
Title
WP Booking System < 2.1.0.2 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
Fixed in
Fixed in 2.1.0.2
CVSS
6.5 (medium)
Published
2026-03-04
Title
WP Booking System – Booking Calendar < 2.0.19.13 - Unauthenticated Information Exposure
Fixed in
Fixed in 2.0.19.13
CVSS
5.3 (medium)
Published
2024-10-24
Title
WP Booking System < 2.0.19.11 - Missing Authorization via wpbs_refresh_calendar_editor
Fixed in
Fixed in 2.0.19.11
CVSS
4.3 (medium)
Published
2024-09-13
Title
WP Booking System – Booking Calendar < 2.0.19.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.0.19.9
CVSS
6.1 (medium)
Published
2023-12-04
Title
WP Booking System < 2.0.19.3 - Missing Authorization
Fixed in
Fixed in 2.0.19.3
CVSS
4.3 (medium)
Published
2023-02-02
Title
WP Booking System < 2.0.18.1 - Admin+ Stored XSS
Fixed in
Fixed in 2.0.18.1
CVSS
3.5 (low)
Published
2021-12-10
Title
WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.15
CVSS
4.8 (medium)
Published
2019-05-22
Title
WP Booking System < 1.5.2 - CSRF to Authenticated SQL Injection
Fixed in
Fixed in 1.5.2
CVSS
7.2 (high)
Published
2017-05-16
Title
WP Booking System < 1.4 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.4
CVSS
6.1 (medium)