Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Wpbookingcalendar Component: Booking Calendar Clear all filters
TI-2024-06429 CVE-2024-6930 · GHSA-pw68-v6p6-7wqw

WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficien…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2024-07-24 No fix listed CWE-79
TI-2024-01122 CVE-2024-1207 · GHSA-3pj6-pjjw-252j

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

Priority MEDIUM 48

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03151 Published 2024-02-08 No fix listed CWE-89
TI-2023-28172 CVE-2023-51520 · GHSA-52rw-98p2-v2g3

WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-02-01 Fixed in 9.7.4 CWE-79
TI-2023-04260 CVE-2023-4620 · GHSA-j6vq-hjmf-4p85

Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS

Priority MEDIUM 60

The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00556 Published 2023-10-16 Fixed in 9.7.3.1