Read the docs

Booking Calendar Project

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Booking Calendar Project records in CISA KEV

No Booking Calendar Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Booking Calendar 10 records MEDIUM

Records

10 records

TI-2022-01337 CVE-2022-1463 · GHSA-w78m-3h49-rcfw

Booking Calendar <= 9.1 - PHP Object Injection via Shortcode

Priority MEDIUM 43

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01716 Published 2022-05-10 No fix listed CWE-502
TI-2021-07318 CVE-2021-25040 · GHSA-98qq-vrv8-7p4q

Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting

Priority LOW 29

The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2022-01-03 Fixed in 8.9.2 CWE-79
TI-2017-01454 CVE-2017-2151 · GHSA-w4m2-ppp7-mr2q

Cross-site scripting in wpdevelop Booking Calendar

Priority LOW 29

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0085 Published 2017-04-28 No fix listed CWE-79
TI-2017-01453 CVE-2017-2150 · GHSA-96wx-4rm6-74cm

Path traversal in wpdevelop Booking Calendar

Priority LOW 29

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.02397 Published 2017-04-28 No fix listed CWE-22
Open these records in search →