Known vulnerabilities in wpdevart Booking calendar, Appointment Booking System
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-73395 | Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking… | 6.5 Medium | Aug 18, 2026 |
| CVE-2026-8840 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all… | 5.3 Medium | Aug 15, 2026 |
| CVE-2026-57778 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows… | 5.3 Medium | Jul 13, 2026 |
| CVE-2026-15289 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via… | 5.9 Medium | Jul 10, 2026 |
| CVE-2026-25435 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking… | 7.1 High | Mar 25, 2026 |
| CVE-2025-67574 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows… | 5.3 Medium | Dec 9, 2025 |
| CVE-2024-12077 | The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via… | 6.1 Medium | Jan 7, 2025 |
| CVE-2024-10856 | The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the… | 6.5 Medium | Dec 24, 2024 |
| CVE-2023-24407 | Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting… | 5.0 Medium | Dec 9, 2024 |
| CVE-2024-9504 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 7.2 High | Nov 26, 2024 |
| CVE-2023-24373 | External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking… | 3.7 Low | Jun 3, 2024 |
| CVE-2022-47428 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking… | 6.7 Medium | Nov 6, 2023 |
| CVE-2022-47438 | Auth | 5.9 Medium | Mar 29, 2023 |
| CVE-2023-24388 | Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System… | 5.4 Medium | Feb 17, 2023 |
Other wpdevart products
Responsive Image Gallery, Gallery Album 5
Organization chart 4
Gallery – Image and Video Gallery with Thumbnails 3
YouTube Embed, Playlist and Popup by WpDevArt 2
Widget Countdown 2
Responsive Vertical Icon Menu 2
Contact Form Builder, Contact Widget 2
Countdown Timer – Widget Countdown 2
booking_calendar 2
Image and Video Lightbox, Image PopUp 1
Pricing Table builder 1
Poll, Survey, Questionnaire and Voting system (WordPress plugin) 1