VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Booking Calendar security & vulnerabilities

booking— active installsLast vulnerability Oct 9, 2026

No known unpatched vulnerabilities in the latest version

All 38 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
38Known vulnerabilities
  • Critical1
  • High8
  • Medium28
  • Low1
Vulnerabilities per year
2014: 1 vulnerability1142016: 3 vulnerabilities3162018: 1 vulnerability1182021: 1 vulnerability1212022: 2 vulnerabilities2222023: 3 vulnerabilities3232024: 6 vulnerabilities6242025: 7 vulnerabilities7252026: 14 vulnerabilities1426

All Booking Calendar vulnerabilities

Booking Calendar vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
≤11.4.3Update to 11.5
CVE-2026-18496
Low2.711.8.2 - Authenticated (Editor+) Information Exposure
10.15 – 11.8.2Update to 11.8.3
CVE-2026-105195
Medium5.3Unauthenticated Information Exposure
<11.8Update to 11.8
CVE-2026-105193
Medium5.3Unauthenticated Duplicate Slot Booking
≤11.8.4Update to 11.9
CVE-2026-39601
Medium6.1Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
≤11.8.3Update to 11.8.4
CVE-2026-93655
Medium6.1Reflected Cross-Site Scripting via 'options' Parameter
≤11.8.2Update to 11.8.3
CVE-2026-92561
High7.2Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
≤11.8.2Update to 11.8.3
CVE-2026-92619
Medium5.3Missing Authorization
≤11.7Update to 11.8
CVE-2026-74002
High7.2Unauthenticated Stored Cross-Site Scripting
≤11.4.2Update to 11.4.3
CVE-2026-59558
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification
≤10.14.14Update to 10.14.15
CVE-2026-2230
Medium4.9Authenticated (Editor+) SQL Injection
≤10.14.15Update to 10.14.16
CVE-2026-32358
Medium5.3Missing Authorization to Unauthenticated Booking Details Exposure
≤10.14.13Update to 10.14.14
CVE-2026-1431
Medium4.3Missing Authorization to Sensitive Information Exposure
≤10.14.11Update to 10.14.12
CVE-2025-14982
Medium5.3Unauthenticated Sensitive Information Exposure
≤10.14.10Update to 10.14.11
CVE-2025-14146
High7.5Unauthenticated SQL Injection via dates_to_check
≤10.14.8Update to 10.14.9
CVE-2025-14383
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode
≤10.14.6Update to 10.14.7
CVE-2025-12804
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤10.14.7Update to 10.14.8
CVE-2025-64381
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤10.14.1Update to 10.14.2
CVE-2025-9346
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
≤10.11.1Update to 10.11.2
CVE-2025-4669
Medium5.3Unauthenticated Post-Confirmation Booking Manipulation
≤10.10Update to 10.10.1
CVE-2024-13821
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode
≤10.9.2Update to 10.9.3
CVE-2024-13323
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤10.6.4Update to 10.6.5
CVE-2024-10893
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤10.6.2Update to 10.6.3
CVE-2024-10027
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤10.6Update to 10.6.1
CVE-2024-9306
Medium6.1Reflected Cross-Site Scripting
≤10.5Update to 10.5.1
CVE-2024-8274
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode
≤10.2.1Update to 10.2.2
CVE-2024-6930
Critical9.8Unauthenticated SQL Injection
≤9.9Update to 9.9.1
CVE-2024-1207
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
<9.7.4Update to 9.7.4
CVE-2023-51520
Medium6.5Unauthenticated Stored Cross-Site Scripting
≤9.7.3Update to 9.7.3.1
CVE-2023-4620
Medium6.6Authenticated (Admin+) SQL Injection
≤9.4.2Update to 9.4.3.1
CVE-2023-23991
Medium5.4Cross-Site Request Forgery
≤9.2.1Update to 9.2.2
CVE-2022-33177
High8.5PHP Object Injection via Shortcode
≤9.1Update to 9.1.1
CVE-2022-1463
Medium6.1Reflected Cross-Site Scripting
≤8.9.1Update to 8.9.2
CVE-2021-25040
High8.8SQL injection
≤8.4.3Update to 8.4.4
CVE-2018-20556
High7.2Authenticated (Editor+) SQL Injection
<6.2.1Update to 6.2.1
—
High8.8Cross-Site Request Forgery to SQL Injection
<6.2.1Update to 6.2.1
—
High8.8Cross-Site Request Forgery leading to Cross-Site Scripting
<6.2.1Update to 6.2.1
—
Medium4.3Cross-Site Request Forgery
<4.1.6Update to 4.1.6
—

Booking Calendar: common questions

Does Booking Calendar have known vulnerabilities?

Yes. VulnCrest Radar lists 38 known vulnerabilities in Booking Calendar: 1 critical, 8 high, 28 medium, 1 low. None are known to affect version null.

How do I check which version of Booking Calendar I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Booking Calendar vulnerability?

CVE-2026-18496, published Oct 9, 2026: Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action. Severity: Medium (CVSS 5.3).

Is any Booking Calendar vulnerability listed in CISA KEV?

No. None of the known Booking Calendar vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?