Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Wpbookingcalendar Component: Wp Booking Calendar Clear all filters
TI-2025-04167 CVE-2025-4669 · GHSA-p3qh-35p5-286g

Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0036 Published 2025-05-17 No fix listed CWE-79
TI-2024-12367 CVE-2024-13323 · GHSA-mfhp-vh86-346w

Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode

Priority LOW 29

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00399 Published 2025-01-14 No fix listed CWE-79
TI-2024-10097 CVE-2024-10893 · GHSA-78rp-3qj9-9ccf

WP Booking Calendar < 10.6.5 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00312 Published 2024-12-03 Fixed in 10.6.5 CWE-79
TI-2024-09307 CVE-2024-10027 · GHSA-2mvw-cmvf-9wp4

WP Booking Calendar < 10.6.3 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even w…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00372 Published 2024-11-07 Fixed in 10.6.3 CWE-79
TI-2024-08638 CVE-2024-9306 · GHSA-h7h7-7vqx-84m4

WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting

Priority LOW 22

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00322 Published 2024-10-04 No fix listed CWE-79
TI-2024-07670 CVE-2024-8274 · GHSA-r3p3-59hh-g3f2

WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00497 Published 2024-08-30 No fix listed CWE-79