Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: Wpbookingcalendar Clear all filters
TI-2025-04167 CVE-2025-4669 · GHSA-p3qh-35p5-286g

Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0036 Published 2025-05-17 No fix listed CWE-79
TI-2024-07445 CVE-2024-8031 · GHSA-p8rv-v842-xwm4

Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download

Priority MEDIUM 62

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2025-05-15 Fixed in 1.2.3 CWE-552
TI-2024-12367 CVE-2024-13323 · GHSA-mfhp-vh86-346w

Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode

Priority LOW 29

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00399 Published 2025-01-14 No fix listed CWE-79
TI-2024-10097 CVE-2024-10893 · GHSA-78rp-3qj9-9ccf

WP Booking Calendar < 10.6.5 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00312 Published 2024-12-03 Fixed in 10.6.5 CWE-79
TI-2024-09307 CVE-2024-10027 · GHSA-2mvw-cmvf-9wp4

WP Booking Calendar < 10.6.3 - Admin+ Stored XSS

Priority MEDIUM 55

The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even w…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00372 Published 2024-11-07 Fixed in 10.6.3 CWE-79
TI-2024-08638 CVE-2024-9306 · GHSA-h7h7-7vqx-84m4

WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting

Priority LOW 22

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00322 Published 2024-10-04 No fix listed CWE-79
TI-2024-07670 CVE-2024-8274 · GHSA-r3p3-59hh-g3f2

WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00497 Published 2024-08-30 No fix listed CWE-79
TI-2024-06429 CVE-2024-6930 · GHSA-pw68-v6p6-7wqw

WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode

Priority LOW 28

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficien…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2024-07-24 No fix listed CWE-79
TI-2024-01122 CVE-2024-1207 · GHSA-3pj6-pjjw-252j

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

Priority MEDIUM 48

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03151 Published 2024-02-08 No fix listed CWE-89
TI-2023-28172 CVE-2023-51520 · GHSA-52rw-98p2-v2g3

WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-02-01 Fixed in 9.7.4 CWE-79
TI-2023-04260 CVE-2023-4620 · GHSA-j6vq-hjmf-4p85

Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS

Priority MEDIUM 60

The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00556 Published 2023-10-16 Fixed in 9.7.3.1