Read the docs

Wpbookingcalendar

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Wpbookingcalendar records in CISA KEV

No Wpbookingcalendar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Booking Calendar 6 records MEDIUM Wp Booking Calendar 6 records MEDIUM Secure Downloads 1 record MEDIUM

Records

6 records in Wp Booking Calendar · all components

TI-2024-10097 CVE-2024-10893 · GHSA-78rp-3qj9-9ccf

WP Booking Calendar < 10.6.5 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00312 Published 2024-12-03 Fixed in 10.6.5 CWE-79
TI-2024-09307 CVE-2024-10027 · GHSA-2mvw-cmvf-9wp4

WP Booking Calendar < 10.6.3 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even w…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00372 Published 2024-11-07 Fixed in 10.6.3 CWE-79
TI-2024-12367 CVE-2024-13323 · GHSA-mfhp-vh86-346w

Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode

Priority LOW 29

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00399 Published 2025-01-14 No fix listed CWE-79
TI-2025-04167 CVE-2025-4669 · GHSA-p3qh-35p5-286g

Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0036 Published 2025-05-17 No fix listed CWE-79
TI-2024-07670 CVE-2024-8274 · GHSA-r3p3-59hh-g3f2

WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00497 Published 2024-08-30 No fix listed CWE-79
TI-2024-08638 CVE-2024-9306 · GHSA-h7h7-7vqx-84m4

WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting

Priority LOW 22

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00322 Published 2024-10-04 No fix listed CWE-79
Open these records in search →