Wpbookingcalendar
1 CVEs across 3 Wpbookingcalendar products. Browse Wpbookingcalendar vulnerabilities, severities, and proof-of-concept exploits.
Wpbookingcalendar products with known CVEs
Wpbookingcalendar CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-4669 | Medium | 6.4 | 2025-05-17 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including… |
CVE-2024-8031 | Medium | 6.5 | 2025-05-15 | The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authentic… |
CVE-2024-13821 | Medium | 5.3 | 2025-02-12 | The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.1… |
CVE-2024-13323 | Medium | 6.4 | 2025-01-14 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and inclu… |
CVE-2024-10893 | Medium | 4.8 | 2024-12-03 | The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-10027 | Medium | 4.8 | 2024-11-07 | The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such a… |
CVE-2024-9306 | Medium | 4.4 | 2024-10-04 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to… |
CVE-2024-8274 | Medium | 6.1 | 2024-08-30 | The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to… |
CVE-2024-6930 | Medium | 6.4 | 2024-07-24 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in… |
CVE-2024-1207 | Critical | 9.8 | 2024-02-08 | The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to… |
CVE-2023-51520 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XS… |
CVE-2023-4620 | Medium | 6.1 | 2023-10-16 | The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stor… |
CVE-2022-33177 | Medium | 5.4 | 2022-09-06 | Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update. |