TI-2018-07335 Aliases CVE-2018-10363 GHSA-j6f5-f95w-5w6q

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System"…

LOW 36CWE-20Published 2018-06-13 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.

Why it matters now

EPSS 0.01345 71st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wpdevart:booking_calendar:2.2.2:::::wordpress::	2.2.2	Vulnerable	wpdevart

cpe:2.3:a:wpdevart:booking_calendar:2.2.2:*:*:*:*:wordpress:*:* Versions 2.2.2 Vulnerable ·wpdevart

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-10363
2026-10-03 Alias added: GHSA-j6f5-f95w-5w6q

References

Advisory 1

https://gist.github.com/B0UG/68d3161af0c0ec85c615ca7452f9755e

TI-2022-03651 Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
TI-2022-23505 WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
TI-2023-09995 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability CVSS 3.1CRITICAL 9.8
TI-2023-10029 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
TI-2024-10064 Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection CVSS 3.1MEDIUM 6.5
TI-2022-23515 WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences