Booking Calendar Contact Form
booking-calendar-contact-form · plugin
Known security vulnerabilities for Booking Calendar Contact Form. Find out in seconds which version runs on your site with WP Lens.
8 known vulnerabilities
1 critical · 4 exploitable without logging in · latest Apr 24, 2026
Listed on wordpress.org · latest 1.2.67 · last updated Aug 17, 2026 · 500+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2016-10909unauthenticated
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
- Medium 6.5
CVE-2025-48231login required≤ 1.2.58
WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerability
- Medium 6.1
CVE-2023-36384unauthenticated · needs a click≤ 1.2.40
WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)
- Medium 6.1
CVE-2016-10908unauthenticated · needs a click
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
- Medium 5.9
CVE-2025-24723high privilege≤ 1.2.55
WordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerability
- Medium 5.3
CVE-2025-13318unauthenticated≤ 1.2.60
Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
- Medium 5.3
CVE-2026-6810subscriber+≤ 1.2.63
Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
- Medium 4.3
CVE-2023-25037login required≤ 1.2.34
WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).