Vulnerabilities

TI-2023-18247 CVE-2023-36384 · GHSA-7hcv-h4hx-q5hg

WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00406 Published 2023-07-18 No fix listed CWE-79

TI-2022-01337 CVE-2022-1463 · GHSA-w78m-3h49-rcfw

Booking Calendar <= 9.1 - PHP Object Injection via Shortcode

MEDIUM 43

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01716 Published 2022-05-10 No fix listed CWE-502

TI-2021-07318 CVE-2021-25040 · GHSA-98qq-vrv8-7p4q

Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting

LOW 29

The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2022-01-03 Fixed in 8.9.2 CWE-79

TI-2018-14579 CVE-2018-20556 · GHSA-44p6-8579-mh2w

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote…

MEDIUM 56

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id parameter.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.18906 Published 2019-03-18 No fix listed CWE-89

TI-2018-04084 CVE-2018-5673 · GHSA-g653-jwh7-jh7g

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

LOW 39

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00768 Published 2018-01-13 No fix listed CWE-352

TI-2018-04083 CVE-2018-5672 · GHSA-jj7q-x98p-6g69

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

LOW 23

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00623 Published 2018-01-13 No fix listed CWE-79

TI-2018-04082 CVE-2018-5671 · GHSA-383m-c825-q95j

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

LOW 23

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00623 Published 2018-01-13 No fix listed CWE-79

TI-2018-04081 CVE-2018-5670 · GHSA-r4rh-r2rm-262p

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

LOW 23

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00623 Published 2018-01-13 No fix listed CWE-79

TI-2017-01454 CVE-2017-2151 · GHSA-w4m2-ppp7-mr2q

Cross-site scripting in wpdevelop Booking Calendar

LOW 29

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0085 Published 2017-04-28 No fix listed CWE-79

TI-2017-01453 CVE-2017-2150 · GHSA-96wx-4rm6-74cm

Path traversal in wpdevelop Booking Calendar

LOW 29

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.02397 Published 2017-04-28 No fix listed CWE-22

Vulnerabilities

Filters