Vulnerabilities

TI-2026-13386 CVE-2026-15984 · GHSA-3566-c9r4-mj76

QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

LOW 38

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00318 Published 2026-09-05 No fix listed CWE-79

TI-2025-26140 CVE-2025-39398 · GHSA-c9gm-698m-cjr7

Missing authorization in Themovation Bellevue

LOW 20

Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00243 Published 2025-05-19 No fix listed CWE-862

TI-2025-23396 CVE-2025-32299 · GHSA-4qr9-wqj5-m42w

WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure Vulnerability

LOW 20

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue af…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00351 Published 2025-05-16 No fix listed CWE-497

Vulnerabilities

Filters

QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

Missing authorization in Themovation Bellevue

WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure Vulnerability