WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
booking-calendar
Published
2023-10-29
Title
Booking Calendar WpDevArt < 3.2.12 - Admin+ SQLi
Slug
booking-calendar
Published
2024-11-25
Title
Booking calendar, Appointment Booking System < 3.2.16 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Slug
booking-calendar
Published
2025-01-06
Title
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
Slug
booking-calendar
Published
2024-12-23
Title
Booking Calendar WpDevArt < 3.2.20 - Authenticated (Contributor+) SQL Injection
Slug
booking-calendar
Published
2025-07-01
Title
Booking calendar, Appointment Booking System < 3.2.18 - Unauthenticated Time-Based SQLi
Slug
booking-calendar
Published
2025-12-15
Title
Booking calendar, Appointment Booking System < 3.2.31 - Missing Authorization
Slug
booking-calendar
Published
2026-03-18
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
Slug
booking-calendar
Published
2026-07-02
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization
Slug
booking-calendar
Published
2026-08-14
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
Slug
booking-calendar
Published
2026-08-18
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Insecure Direct Object Reference
Slug
booking-calendar
Published
2026-08-17
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
Slug
booking-calendar-and-notification
Published
2025-02-28
Title
Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Unauthenticated SQL Injection
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Authentication Bypass
Slug
booking-calendar-contact-form
Published
2015-05-13
Title
Booking Calendar Contact Form <= 1.0.2 - Multiple Authenticated Vulnerabilities
Slug
booking-calendar-contact-form
Published
2016-02-08
Title
Booking Calendar Contact Form < 1.0.24 - XSS & SQL Injection
Slug
booking-calendar-contact-form
Published
2023-07-18
Title
Booking Calendar Contact Form < 1.2.41 - Unauthenticated Reflected Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-01-24
Title
Booking Calendar Contact Form < 1.2.56 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-06-30
Title
Booking Calendar Contact Form < 1.2.59 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2025-11-21
Title
Booking Calendar Contact Form < 1.2.61 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
Slug
booking-calendar-contact-form
Published
2026-04-23
Title
Booking Calendar Contact Form < 1.2.64 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
Slug
booking-calendar-contact-form
Published
2026-06-15
Title
Booking Calendar Contact Form < 1.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
booking-calendar-contact-form
Published
2026-06-15
Title
Booking Calendar Contact Form < 1.1.25 - Unauthenticated Stored Cross-Site Scripting
Slug
booking-calendar-pro
Published
2025-01-06
Title
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
Slug
booking-calendar-pro-payment
Published
2022-11-21
Title
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload