Booking Calendar
Booking Calendar has 30 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 30 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 7 high. 2025 was the busiest year with 7 disclosures.
The most common weakness is Cross-Site Scripting, behind 15 of the records (50%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).
Every one of the 30 issues recorded for Booking Calendar has a vendor fix available, so running the current release closes all known holes.
25 independent researchers contributed these findings, most of them (3) reported by Edwin Molenaar. Booking Calendar is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-1207Booking Calendar <= 9.9 - Unauthenticated SQL Injection
Read the full analysisVulnerability Records

Booking Calendar
Author
wpdevelop
Booking Calendar – Booking Plugin for Appointments, Reservations, Rentals, Events WP Booking Calendar is a flexible WordPress booking plugin for appointments, reservations, rentals, and events. Add a responsive availability calendar and booking form to your website, accept online bookings, and manage them from a modern admin panel. Use Booking Calendar for full-day bookings, time-slot appointments, service scheduling, event registration, inquiry forms, request forms, or even as a simple multi-step contact form with built-in request listing and email notifications. Features | See Demos | FAQ | Get Support Best for appointments, service scheduling, property rentals, equipment rentals, consultations, classes, events, and availability management. Key Features Accept full-day, appointment, and time-slot bookings. Display availability and prevent double bookings. Create customizable booking and inquiry forms. Manage, approve, decline, and edit bookings in WordPress. Send email notifications to administrators and customers. Build multi-step forms with the Drag & Drop Form Builder. Block unavailable dates and time intervals. Synchronize bookings using .ics feeds. Import Google Calendar events. Use responsive booking forms on desktop and mobile. Booking Calendar for Different Businesses Use Booking Calendar for appointment scheduling, service reservations, property and equipment rentals, consultations, classes, events, and other availability-based bookings. Booking Calendar Free includes the essential tools for displaying availability, accepting booking requests, preventing double bookings, sending notifications, and managing reservations in WordPress. Paid editions add multiple booking resources, online payments, seasonal pricing, advanced availability rules, availability search, and MultiUser administration. Full-Day Booking Process in Booking Calendar Free Let visitors complete a full-day property booking through a clear two-step flow. Customers select a property, review available, booked, and pending dates, choose their check-in and check-out dates, enter their contact details, and submit the booking request. The confirmation displays the complete booking summary and provides an option to add the selected dates to Google Calendar. Appointment Booking with Services and Providers Let visitors book appointments through a simple step-by-step flow. Customers choose a Service and an available Provider, select a date and start time, enter their contact details, and submit the booking. The confirmation displays the complete appointment details and provides an option to add the appointment to Google Calendar.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C