Bookit — Booking & Appointment Calendar

Bookit — Booking & Appointment Calendar has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2023 was the busiest year with 3 disclosures.

The most common weakness is Missing Authorization, behind 5 of the records (56%). Other recurring categories include Authentication Bypass Using An Alternate Path Or Channel, Cross-Site Scripting.

Every one of the 9 issues recorded for Bookit — Booking & Appointment Calendar has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, one record each. Bookit — Booking & Appointment Calendar is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

9

Get automatic notifications for all Bookit — Booking & Appointment Calendar vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2023-2834

BookIt <= 2.3.7 - Authentication Bypass

Read the full analysis

Vulnerability Records

9 records
Bookit — Booking & Appointment Calendar banner
Latestv2.6.0.4

Bookit — Booking & Appointment Calendar

Nexcess

Author

Nexcess

3.8(24)
76/100
Last Updated
2026-09-01 (11d ago)
Active Installs
4,000+
Downloads
231,489
Requires WP
6.3+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2019-01-31 (8y ago)

Bookit adds an appointment booking system and event calendar to your WordPress site. You define services, staff, working hours, and prices; visitors pick a date and time and submit a booking. The plugin prevents double-booking and sends configurable email notifications. What you can do: Define multiple services with duration and price; assign staff and set their working hours and days. Show availability in daily, weekly, or monthly calendar views. Place a booking form on any page via shortcode or with Elementor and WPBakery widgets. Let customers choose a service and staff, see available slots, and submit a booking (no account required unless you enable it). Receive and send email notifications for new, updated, or upcoming appointments; templates are editable in settings. Manage all appointments from the admin dashboard; optional Stripe payments in the free version. Optional BookIt Pro add-ons add WooCommerce integration, Google Calendar sync, drag-and-drop custom fields, and additional payment options (e.g. PayPal). Documentation and support are available at bookitwp.com.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C