Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress

Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress has 20 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 20 are fixed as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 8 high. 2024 was the busiest year with 9 disclosures.

The most common weakness is SQL Injection, behind 6 of the records (30%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Unrestricted Upload Of File With Dangerous Type.

Every one of the 20 issues recorded for Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress has a vendor fix available, so running the current release closes all known holes.

18 independent researchers contributed these findings, most of them (2) reported by Arkadiusz Hydzik.

Strategic Overview

Avg CVSSMedium

7.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-7350

Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover

Read the full analysis

Vulnerability Records

20 records


2026-08-29 00:00	Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation Appointment Booking Calendar Plugin… 1.5.6 – 1.6.2	`CVE-2026-76586`	7.3 High	Nguyen Phuoc Thinh	Yes
2026-06-17 00:00	BookingPress <= 1.5.5 - Unauthenticated PHP Object Injection Appointment Booking Calendar Plugin… <= 1.5.5	`CVE-2026-12378`	8.1 High	Sanjar Tulkinov	Yes
2025-04-01 00:00	BookingPress <= 1.1.28 - Authenticated (Administrator+) SQL Injection Appointment Booking Calendar Plugin… <= 1.1.28	`CVE-2025-31910`	4.9 Medium	Phat RiO	Yes
2025-01-24 00:00	BookingPress <= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting Appointment Booking Calendar Plugin… <= 1.1.25	`CVE-2025-24732`	6.4 Medium	zaim	Yes
2024-12-23 00:00	BookingPress <= 1.1.22 - Unauthenticated File Export Download Appointment Booking Calendar Plugin… <= 1.1.22	`CVE-2024-12274`	5.3 Medium	Thanh Hang	Yes
2024-12-23 00:00	Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection Appointment Booking Calendar Plugin… <= 1.1.21	`CVE-2024-11726`	6.5 Medium	shaman0x01	Yes
2024-11-01 00:00	Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.16 - Authenticated (Subscriber+) SQL Injection Appointment Booking Calendar Plugin… <= 1.1.16	`CVE-2024-10540`	5.3 Medium	Arkadiusz Hydzik	Yes
2024-08-07 00:00	Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover Appointment Booking Calendar Plugin… 1.1.6 – 1.1.7	`CVE-2024-7350`	9.8 Critical	Gibran Abdillah	Yes
2024-07-16 18:09	BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload Appointment Booking Calendar Plugin… <= 1.1.5	`CVE-2024-6660`	8.8 High	shaman0x01	Yes
2024-07-16 00:00	BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation Appointment Booking Calendar Plugin… <= 1.1.5	`CVE-2024-6467`	8.8 High	Arkadiusz Hydzik	Yes

Showing 1–10 of 20 reports