Booking Calendar

Explore Booking Calendar vulnerabilities across all versions. Currently tracking 29 known vulnerabilities, including severity, impact, and patch status.

01234567891015.08.2009Today01.08.20144.3Booking Calendar < 4.1.6 - Cross-Site Request Forgery CVSS 4.3 · 01.08.201401.08.20168.8Booking Calendar <= 6.2 - Cross-Site Request Forgery to SQL Injection CVSS 8.8 · 01.08.20167.2Booking Calendar <= 6.2 - Authenticated (Editor+) SQL Injection CVSS 7.2 · 01.08.20168.8Booking Calendar <= 6.2 - Cross-Site Request Forgery leading to Cross-Site Scripting CVSS 8.8 · 01.08.201628.12.20188.8Booking Calendar <= 8.4.3 - SQL injection CVSS 8.8 · 28.12.201806.12.20216.1Booking Calendar <= 8.9.1 - Reflected Cross-Site Scripting CVSS 6.1 · 06.12.202118.04.20228.5Booking Calendar <= 9.1 - PHP Object Injection via Shortcode CVSS 8.5 · 18.04.202206.09.20225.4Booking Calendar <= 9.2.1 - Cross-Site Request Forgery CVSS 5.4 · 06.09.202220.01.20236.6Booking Calendar <= 9.4.2 - Authenticated (Admin+) SQL Injection CVSS 6.6 · 20.01.202311.09.20236.5Booking Calendar <= 9.7.3 - Unauthenticated Stored Cross-Site Scripting CVSS 6.5 · 11.09.202325.09.20236.4Booking Calendar <= 9.7.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode CVSS 6.4 · 25.09.202307.02.20249.8Booking Calendar <= 9.9 - Unauthenticated SQL Injection CVSS 9.8 · 07.02.202423.07.20246.4WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode CVSS 6.4 · 23.07.202429.08.20246.1WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting CVSS 6.1 · 29.08.202403.10.20244.4WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 03.10.202417.10.20244.4WP Booking Calendar <= 10.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 17.10.202414.11.20244.4WP Booking Calendar <= 10.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 14.11.202413.01.20256.4Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode CVSS 6.4 · 13.01.202511.02.20255.3WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation CVSS 5.3 · 11.02.202516.05.20256.4Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode CVSS 6.4 · 16.05.202527.08.20256.4Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 27.08.202513.11.20256.4Booking Calendar <= 10.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 13.11.202504.12.20256.4Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode CVSS 6.4 · 04.12.202515.12.20257.5Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check CVSS 7.5 · 15.12.202508.01.20265.3Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure CVSS 5.3 · 08.01.202615.01.20264.3Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure CVSS 4.3 · 15.01.202630.01.20265.3Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure CVSS 5.3 · 30.01.202614.02.20264.9Booking Calendar <= 10.14.15 - Authenticated (Editor+) SQL Injection CVSS 4.9 · 14.02.202617.02.20264.3Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification CVSS 4.3 · 17.02.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

29

Get automatic notifications for all Booking Calendar vulnerabilities before they are exploited.

Vulnerability Records

29 records
2026-02-17 00:00CVE-2026-2230
4.3
Medium
Tarcísio Luchesi De Almeida Silva (Poystick)Yes
2026-02-14 00:00CVE-2026-32358
4.9
Medium
Drew Webber (mcdruid)Yes
2026-01-30 16:06CVE-2026-1431
5.3
Medium
type5afeYes
2026-01-15 16:11CVE-2025-14982
4.3
Medium
shark3yYes
2026-01-08 19:08CVE-2025-14146
5.3
Medium
Filippo DecortesYes
2025-12-15 02:24CVE-2025-14383
7.5
High
Marcin Dudek (dudekmar)Yes
2025-12-04 13:08CVE-2025-12804
6.4
Medium
Muhammad Yudha - DJYes
2025-11-13 00:00CVE-2025-64381
6.4
Medium
Peter ThaleikisYes
2025-08-27 00:00CVE-2025-9346
6.4
Medium
Cody SixteenYes
2025-05-16 21:35CVE-2025-4669
6.4
Medium
Muhammad Yudha - DJYes
Showing 1–10 of 29 reports
Booking Calendar banner
Latestv11.4.3

Booking Calendar

wpdevelop

Author

wpdevelop

4.7(653)
94/100
Last Updated
2026-07-20 (9d ago)
Active Installs
50,000+
Downloads
5,163,811
Requires WP
5.3+
Requires PHP
5.6+
Tested up to
WP 7.0.2
Created
2009-08-15 (17y ago)

Booking Calendar – Booking Plugin for Appointments, Reservations, Rentals, Events WP Booking Calendar is a flexible WordPress booking plugin for appointments, reservations, rentals, and events. Add a responsive availability calendar and booking form to your website, accept online bookings, and manage them from a modern admin panel. Use Booking Calendar for full-day bookings, time-slot appointments, service scheduling, event registration, inquiry forms, request forms, or even as a simple multi-steps contact form with built-in request listing and email notifications. Features | See Demos | FAQ | Get Support Best for appointments, service scheduling, property rentals, equipment rentals, consultations, classes, events, and availability management. Key Features Block unavailable time intervals by resource and date range Create admin bookings from selected available time slots Configure global availability rules with live preview Accept full-day and time-slot bookings Show calendar availability on your website Create booking, contact, and inquiry forms Use the new Drag & Drop Booking Form Builder Build multi-step forms with rows and columns Customize form fields and email notifications Prevent double bookings Manage bookings in a clear admin panel Sync bookings with external services using .ics feeds Import Google Calendar events Works for properties, services, rentals, and events New Time Slots Availability & Fast Admin Booking Manage unavailable time intervals visually from Booking Calendar > Availability or directly from the bookings workflow using the new Time Slots Availability popup. Administrators can choose a date range and block or unblock exact time intervals in an interactive timeline. The timeline clearly shows available, booked, unavailable, and full-day unavailable states, and full-day unavailable states, making it much easier to understand real availability at a glance. Administrators can also create a new booking directly from an available time interval. Simply select an available time slot in the popup, open the booking form with the selected resource, date, start time, and end time already prefilled, and save it as a new booking. This makes Booking Calendar especially useful for appointment scheduling, service bookings, consultations, rentals, and any workflow where administrators need to quickly review availability and create bookings from the WordPress admin panel. New Drag & Drop Booking Form Builder Create booking forms visually without manually editing complex shortcodes or form code. Simply drag fields from the sidebar, drop them into the canvas, organize them into rows and columns, edit settings in the sidebar, and preview changes instantly. The new builder also makes it easy to create contact and inquiry forms where the calendar is optional. With the new interface, you can: drag and drop fields into the form layout, organize fields into sections and columns, create multi-step form pages, resize columns for better layout control, edit field settings in the right sidebar, instantly preview the form while building. This new functionality brings a more modern, user-friendly, and flexible way to create forms in Booking Calendar, making form setup faster, clearer, and much more convenient for website owners. Perfect solution for any booking logic As the first booking system for WordPress, we have created a huge number of features to match your specific booking needs. Easily define available dates and allow your visitors to reserve your property or service for a full day or time-slot. For those who need more advanced functionality, our premium versions offer an extensive system with multiple resources, seasonal prices, conditional dates selection, availability search, and even a multi-user system where users can independently manage their own availability, much like an Airbnb portal. Full Day Bookings – Drag and Drop Booking Form Builder Easily configure Booking Calendar for full-day bookings with the new Drag and Drop Booking Form Builder. The new Booking Calendar Form Builder makes it much easier to create flexible booking forms without manually editing form code. It is a simple and visual way to build booking forms for different use cases directly inside WordPress. Appointment Forms with Time Slots or Start Time + Service Duration Selection Create a time-slot booking form in just a few minutes with the new Booking Calendar Form Builder. Visually add the calendar, time fields, and contact fields, adjust the layout, and preview changes instantly — without manually editing form code. Changeover Multi-Day Bookings – Setup Wizard (Pro) Configure multi-day bookings with specific check-in and check-out days, clearly marked with diagonal or vertical lines. Perfect for bookings that require split days. Available Pro versions.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C