WordPress plugin
Appointment Hour Booking – Booking Calendar security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 16 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium14
- Low0
All Appointment Hour Booking – Booking Calendar vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer ≤1.5.97Update to 1.5.98 | CVE-2026-96573 | |
| Medium5.3 | Unauthenticated Appointment Slot Capacity Bypass ≤1.5.94Update to 1.5.95 | CVE-2026-86475 | |
| Medium5.3 | Missing Authorization ≤1.5.94Update to 1.5.95 | CVE-2026-66679 | |
| Medium5.3 | Unauthenticated Price Manipulation ≤1.5.87Update to 1.5.88 | CVE-2026-16282 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.5.86Update to 1.5.87 | CVE-2026-65514 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration ≤1.5.60Update to 1.5.61 | CVE-2026-1083 | |
| Medium5.3 | Captcha Bypass ≤1.4.56Update to 1.4.57 | CVE-2024-32720 | |
| Medium5.3 | Missing Authorization to Double Booking ≤1.4.23Update to 1.4.24 | CVE-2023-45649 | |
| Medium5.3 | CAPTCHA Bypass ≤1.3.72Update to 1.3.73 | CVE-2022-4036 | |
| High7.2 | Unauthenticated iFrame Injection via Appointment Form ≤1.3.72Update to 1.3.73 | CVE-2022-4035 | |
| Medium5.8 | CSV Injection ≤1.3.72Update to 1.3.73 | CVE-2022-4034 | |
| Medium4.3 | Missing Authorization ≤1.3.71Update to 1.3.72 | CVE-2022-41692 | |
| Medium4.8 | Authenticated Stored Cross-Site Scripting ≤1.3.55Update to 1.3.56 | CVE-2022-1710 | |
| Medium6.4 | Cross-Site Scripting <1.3.17Update to 1.3.17 | CVE-2021-24712 | |
| Medium5.5 | Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting <1.3.16Update to 1.3.16 | CVE-2021-24673 | |
| Medium6.1 | Cross-Site Scripting <1.1.46Update to 1.1.46 | CVE-2019-13505 |
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
≤1.5.97Update to 1.5.98
- Medium5.3Unauthenticated Appointment Slot Capacity Bypass
≤1.5.94Update to 1.5.95
- Medium5.3Missing Authorization
≤1.5.94Update to 1.5.95
- Medium5.3Unauthenticated Price Manipulation
≤1.5.87Update to 1.5.88
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.5.86Update to 1.5.87
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration
≤1.5.60Update to 1.5.61
- Medium5.3Captcha Bypass
≤1.4.56Update to 1.4.57
- Medium5.3Missing Authorization to Double Booking
≤1.4.23Update to 1.4.24
- Medium5.3CAPTCHA Bypass
≤1.3.72Update to 1.3.73
- High7.2Unauthenticated iFrame Injection via Appointment Form
≤1.3.72Update to 1.3.73
- Medium5.8CSV Injection
≤1.3.72Update to 1.3.73
- Medium4.3Missing Authorization
≤1.3.71Update to 1.3.72
- Medium4.8Authenticated Stored Cross-Site Scripting
≤1.3.55Update to 1.3.56
- Medium6.4Cross-Site Scripting
<1.3.17Update to 1.3.17
- Medium5.5Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting
<1.3.16Update to 1.3.16
- Medium6.1Cross-Site Scripting
<1.1.46Update to 1.1.46
Appointment Hour Booking – Booking Calendar: common questions
Does Appointment Hour Booking – Booking Calendar have known vulnerabilities?
Yes. VulnCrest Radar lists 16 known vulnerabilities in Appointment Hour Booking – Booking Calendar: 2 high, 14 medium. None are known to affect version null.
How do I check which version of Appointment Hour Booking – Booking Calendar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Appointment Hour Booking – Booking Calendar vulnerability?
CVE-2026-96573, published Sep 30, 2026: Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer. Severity: High (CVSS 7.2).
Is any Appointment Hour Booking – Booking Calendar vulnerability listed in CISA KEV?
No. None of the known Appointment Hour Booking – Booking Calendar vulnerabilities is currently listed in the CISA KEV catalog.