WordPress plugin
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High8
- Medium10
- Low0
All Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.3 | 1.6.2 - Unauthenticated Booking Price Manipulation 1.5.6 – 1.6.2Update to 1.6.3 | CVE-2026-76586 | |
| High8.1 | Unauthenticated PHP Object Injection ≤1.5.5Update to 1.5.6 | CVE-2026-12378 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection ≤1.1.28Update to 1.1.38 | CVE-2025-31910 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.1.25Update to 1.1.26 | CVE-2025-24732 | |
| Medium6.5 | Authenticated (Contributor+) SQL Injection ≤1.1.21Update to 1.1.22 | CVE-2024-11726 | |
| Medium5.3 | Unauthenticated File Export Download ≤1.1.22Update to 1.1.23 | CVE-2024-12274 | |
| Medium5.3 | Authenticated (Subscriber+) SQL Injection ≤1.1.16Update to 1.1.17 | CVE-2024-10540 | |
| Critical9.8 | 1.1.7 - Authentication Bypass to Account Takeover 1.1.6 – 1.1.7Update to 1.1.8 | CVE-2024-7350 | |
| High8.8 | Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload ≤1.1.5Update to 1.1.6 | CVE-2024-6660 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation ≤1.1.5Update to 1.1.6 | CVE-2024-6467 | |
| Medium5.3 | Missing Authorization to Appointment Time Alteration ≤1.0.82Update to 1.0.83 | CVE-2024-34799 | |
| Medium4.3 | Authenticated (Customer+) Insecure Direct Object Reference ≤1.0.81Update to 1.0.82 | CVE-2024-31296 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload ≤1.0.87Update to 1.0.88 | CVE-2024-3022 | |
| High7.5 | Booking Price Manipulation via bookingpress_confirm_booking ≤1.0.74Update to 1.0.75 | CVE-2023-51405 | |
| High8.8 | Authenticated (Contributor+) SQL Injection ≤1.0.72Update to 1.0.73 | CVE-2023-50841 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload ≤1.0.76Update to 1.0.77 | CVE-2023-6219 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure ≤1.0.64Update to 1.0.65 | CVE-2023-36507 | |
| Medium6.5 | Unauthenticated Insecure Direct Object Reference ≤1.0.30Update to 1.0.31 | CVE-2022-4340 | |
| Medium6.4 | SQL Injection ≤1.0.13Update to 1.0.14 | — | |
| Critical9.8 | SQL Injection <1.0.11Update to 1.0.11 | CVE-2022-0739 |
- High7.31.6.2 - Unauthenticated Booking Price Manipulation
1.5.6 – 1.6.2Update to 1.6.3
- High8.1Unauthenticated PHP Object Injection
≤1.5.5Update to 1.5.6
- Medium4.9Authenticated (Administrator+) SQL Injection
≤1.1.28Update to 1.1.38
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.1.25Update to 1.1.26
- Medium6.5Authenticated (Contributor+) SQL Injection
≤1.1.21Update to 1.1.22
- Medium5.3Unauthenticated File Export Download
≤1.1.22Update to 1.1.23
- Medium5.3Authenticated (Subscriber+) SQL Injection
≤1.1.16Update to 1.1.17
- Critical9.81.1.7 - Authentication Bypass to Account Takeover
1.1.6 – 1.1.7Update to 1.1.8
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload
≤1.1.5Update to 1.1.6
- High8.8Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation
≤1.1.5Update to 1.1.6
- Medium5.3Missing Authorization to Appointment Time Alteration
≤1.0.82Update to 1.0.83
- Medium4.3Authenticated (Customer+) Insecure Direct Object Reference
≤1.0.81Update to 1.0.82
- High7.2Authenticated (Admin+) Arbitrary File Upload
≤1.0.87Update to 1.0.88
- High7.5Booking Price Manipulation via bookingpress_confirm_booking
≤1.0.74Update to 1.0.75
- High8.8Authenticated (Contributor+) SQL Injection
≤1.0.72Update to 1.0.73
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤1.0.76Update to 1.0.77
- Medium5.3Unauthenticated Sensitive Information Exposure
≤1.0.64Update to 1.0.65
- Medium6.5Unauthenticated Insecure Direct Object Reference
≤1.0.30Update to 1.0.31
- Medium6.4SQL Injection
≤1.0.13Update to 1.0.14
- Critical9.8SQL Injection
<1.0.11Update to 1.0.11
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: common questions
Does Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: 2 critical, 8 high, 10 medium. None are known to affect version null.
How do I check which version of Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress vulnerability?
CVE-2026-76586, published Aug 29, 2026: Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation. Severity: High (CVSS 7.3).
Is any Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress vulnerability listed in CISA KEV?
No. None of the known Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress vulnerabilities is currently listed in the CISA KEV catalog.