Read the docs

Wpbookingcalendar

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Wpbookingcalendar records in CISA KEV

No Wpbookingcalendar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Booking Calendar 6 records MEDIUM Wp Booking Calendar 6 records MEDIUM Secure Downloads 1 record MEDIUM

Records

6 records in Booking Calendar · all components

TI-2023-04260 CVE-2023-4620 · GHSA-j6vq-hjmf-4p85

Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS

Priority MEDIUM 60

The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00556 Published 2023-10-16 Fixed in 9.7.3.1
TI-2024-01122 CVE-2024-1207 · GHSA-3pj6-pjjw-252j

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

Priority MEDIUM 48

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03151 Published 2024-02-08 No fix listed CWE-89
TI-2023-28172 CVE-2023-51520 · GHSA-52rw-98p2-v2g3

WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-02-01 Fixed in 9.7.4 CWE-79
TI-2024-06429 CVE-2024-6930 · GHSA-pw68-v6p6-7wqw

WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficien…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2024-07-24 No fix listed CWE-79
Open these records in search →