TI-2022-16736 Aliases CVE-2022-36399 GHSA-54wr-xmjg-j9mj

WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data Exposure

LOW 33CWE-200Published 2023-12-28 · Updated 2026-04-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.

Why it matters now

EPSS 0.00531 45th percentileScored 2026-11-07

Fix Fixed Booked - Appointment Booking for WordPress | Calendars (BoxyStudio): 2.4.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
XjSv	Booked - Appointment Booking for WordPress \| Calendars	before 2.4.4	2.4.4	Patch available	CNA

Booked - Appointment Booking for WordPress | Calendars VendorXjSv Affected before 2.4.4 Fixed in 2.4.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:boxystudio:booked::::::wordpress::*	before 2.4.4	Vulnerable	XjSv

cpe:2.3:a:boxystudio:booked:*:*:*:*:*:wordpress:*:* Versions before 2.4.4 Vulnerable ·XjSv

Remediation

Fix · CNA Booked - Appointment Booking for WordPress | Calendars (BoxyStudio) Fixed in 2.4.4

Timeline

2026-10-02 Threatist record created from CVE-2022-36399
2026-10-03 Alias added: GHSA-54wr-xmjg-j9mj

References

Advisory 1

https://patchstack.com/database/vulnerability/booked/wordpress-booked-plugin-2-4-unauth-appointment-data-exposure-vulnerability?_s_id=cve

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences