WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-03-23
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.6.1 - Missing Authorization
Slug
booking-calendar
Published
2018-01-12
Title
Booking Calendar <= 2.1.7 - Authenticated Stored XSS & CSRF
Slug
booking-calendar
Published
2018-06-07
Title
Booking Calendar < 2.2.3 - Parameters Tampering Allowing Arbitrary Prices Change
Slug
booking-calendar
Published
2022-11-21
Title
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
Slug
booking-calendar
Published
2023-01-27
Title
Booking calendar, Appointment Booking System < 3.2.4 - Form Creation/Update/Deletion/Duplication via CSRF
Slug
booking-calendar
Published
2023-01-27
Title
Booking calendar, Appointment Booking System < 3.2.4 - Editor+ Stored XSS
Slug
booking-calendar
Published
2023-04-19
Title
Booking calendar, Appointment Booking System < 3.2.8 - Admin+ SQLi
Slug
booking-calendar
Published
2023-09-12
Title
Booking calendar, Appointment Booking System < 3.2.9 - Multiple Authenticated(Editor+) SQL Injection
Slug
booking-calendar
Published
2023-10-29
Title
Booking Calendar WpDevArt < 3.2.12 - Admin+ SQLi
Slug
booking-calendar
Published
2024-11-25
Title
Booking calendar, Appointment Booking System < 3.2.16 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Slug
booking-calendar
Published
2025-01-06
Title
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
Slug
booking-calendar
Published
2024-12-23
Title
Booking Calendar WpDevArt < 3.2.20 - Authenticated (Contributor+) SQL Injection
Slug
booking-calendar
Published
2025-07-01
Title
Booking calendar, Appointment Booking System < 3.2.18 - Unauthenticated Time-Based SQLi
Slug
booking-calendar
Published
2025-12-15
Title
Booking calendar, Appointment Booking System < 3.2.31 - Missing Authorization
Slug
booking-calendar
Published
2026-03-18
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
Slug
booking-calendar-and-notification
Published
2025-02-28
Title
Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Unauthenticated SQL Injection
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Authentication Bypass
Slug
booking-calendar-contact-form
Published
2015-05-13
Title
Booking Calendar Contact Form <= 1.0.2 - Multiple Authenticated Vulnerabilities
Slug
booking-calendar-contact-form
Published
2016-02-08
Title
Booking Calendar Contact Form < 1.0.24 - XSS & SQL Injection
Slug
booking-calendar-contact-form
Published
2023-07-18
Title
Booking Calendar Contact Form < 1.2.41 - Unauthenticated Reflected Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-01-24
Title
Booking Calendar Contact Form < 1.2.56 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-06-30
Title
Booking Calendar Contact Form < 1.2.59 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-11-21
Title
Booking Calendar Contact Form < 1.2.61 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
Slug
booking-calendar-contact-form
Published
2026-04-23
Title
Booking Calendar Contact Form < 1.2.64 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover