2.7
Low
CVE-2026-105195 The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user…
Description
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Booking Calendar 10.15 | 10.15 → < 11.8.3 | 11.8.3 |
Other CVEs of Booking Calendar
The 4 CVEs of Booking Calendar →
CVE-2026-105193
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient…
4.8
Medium
CVE-2023-4620
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data,…
6.1
Medium
CVE-2021-25040
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before…
Not rated