Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: codepeople Component: Appointment Booking Calendar Clear all filters
TI-2025-28999 CVE-2025-46247 · GHSA-v9xw-qh54-24j3

WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability

Priority MEDIUM 48

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar:…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.004 Published 2025-04-22 No fix listed CWE-862
TI-2024-11385 CVE-2024-12274 · GHSA-pw9j-qgmc-g62h

BookingPress < 1.1.23 - Unauthenticated Export File Download

Priority HIGH 72

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated att…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00648 Published 2025-01-13 Fixed in 1.1.23
TI-2024-00790 CVE-2024-0856 · GHSA-27hg-5398-wvrh

Booking Calendar < 1.3.83 - CSRF appointment scheduling

Priority HIGH 73

The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a boo…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00384 Published 2024-03-20 Fixed in 1.3.83 CWE-352
TI-2020-07494 CVE-2020-9372 · GHSA-68xc-xqw9-7x6f

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in…

Priority MEDIUM 45

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.08612 Published 2020-03-04 No fix listed CWE-1236
TI-2015-06088 CVE-2015-7320 · GHSA-pfm9-r9qx-fqwf

Multiple cross-site scripting (XSS) vulnerabilities in…

Priority LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary w…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02137 Published 2015-09-29 No fix listed CWE-79