Skip to content
Noroxi

Booking Calendar

booking · plugin

Known security vulnerabilities for Booking Calendar. Find out in seconds which version runs on your site with WP Lens.

25 known vulnerabilities

1 critical · 12 exploitable without logging in · 1 with public exploit code · latest Oct 2, 2026

Listed on wordpress.org · latest 11.9 · last updated Oct 3, 2026 · 40K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2024-1207unauthenticated≤ 9.9

    Booking Calendar <= 9.9 - Unauthenticated SQL Injection

    Critical 9.8

  • CVE-2026-32358high privilege≤ 10.14.15

    WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability

    High 7.6

  • CVE-2023-23991high privilege≤ 9.4.3

    WordPress Booking Calendar plugin <= 9.4.3 - SQL Injection

    High 7.6

  • CVE-2025-14383unauthenticated≤ 10.14.8

    Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check

    High 7.5

  • CVE-2026-92619editor+≤ 11.8.2

    Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter

    High 7.2

  • CVE-2026-59558unauthenticated · needs a click≤ 11.4.2

    WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-64381login required≤ 10.14.7

    WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2025-12804contributor+≤ 10.14.6

    Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode

    Medium 6.4

  • CVE-2025-9346contributor+≤ 10.14.1

    Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2026-93655unauthenticated · needs a click≤ 11.8.3

    Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter

    Medium 6.1

  • CVE-2026-92561unauthenticated · needs a click≤ 11.8.2

    Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter

    Medium 6.1

  • CVE-2024-8274unauthenticated · needs a click≤ 10.5

    WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2023-51520login required→ 9.7.4

    WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2025-4669contributor+≤ 10.11.1

    Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode

    Medium 5.4

  • CVE-2024-13323contributor+≤ 10.9.2

    Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode

    Medium 5.4

  • CVE-2024-6930contributor+≤ 10.2.1

    WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode

    Medium 5.4

  • CVE-2026-74002unauthenticated≤ 11.7

    WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2026-1431unauthenticated≤ 10.14.13

    Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure

    Medium 5.3

  • CVE-2025-14146unauthenticated≤ 10.14.10

    Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure

    Medium 5.3

  • CVE-2024-13821unauthenticated≤ 10.10

    WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation

    Medium 5.3

  • CVE-2024-9306admin≤ 10.6

    WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting

    Medium 4.8

  • CVE-2022-33177unauthenticated · needs a click≤ 9.2.1

    WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulity

    Medium 4.3

  • CVE-2026-2230subscriber+≤ 10.14.14

    Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification

    Medium 4.3

  • CVE-2025-14982subscriber+≤ 10.14.11

    Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure

    Medium 4.3

  • CVE-2026-39601unauthenticated≤ 11.8.4

    WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability

    Low 3.7

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory