Creavi Appointment Booking Calendar

Creavi Appointment Booking Calendar has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Creavi Appointment Booking Calendar has a vendor fix available, so running the current release closes it.

All of these findings were reported by Athiwat Tiprasaharn (Jitlada). Creavi Appointment Booking Calendar is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Creavi Appointment Booking Calendar vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-1856

Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label

Read the full analysis

Vulnerability Records

1 records
Creavi Appointment Booking Calendar banner
Latestv1.7.0

Creavi Appointment Booking Calendar

Creavi

Author

Creavi

5.0(5)
100/100
Last Updated
2026-10-13 (6d ago)
Active Installs
70+
Downloads
3,609
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2025-07-15 (1y ago)

Creavi Appointment Booking Calendar is a clean, beautiful, and scalable appointment booking plugin for WordPress. It is simple to launch, easy to integrate, and free to use without plugin-imposed service or booking limits. Create bookable services, define availability, collect the details you need, and let customers schedule through a polished calendar flow. The modern service editor combines clear settings with a live preview, so every step is easy to understand and customize. Connect Google Calendar or Outlook Calendar for free to create events and block busy times. Offer in-person appointments, phone calls, custom meeting links, or free video meetings generated by the plugin. Confirmation emails, reminders, calendar files, timezone handling, and booking buffers are included. Add Creavi anywhere with shortcodes, Gutenberg blocks, Elementor, or another page builder. Use an inline calendar or a styled popup button, and scale from one service to as many services and bookings as your WordPress hosting can support—without a monthly booking-software fee. Service Catalogs for more ways to book Create an online service catalog as a simple list or organized categories. Customers can choose a treatment, consultation, or session, compare available providers, and book a time that fits the service duration. This flexible appointment booking flow works for hair and beauty salons, nail studios, dental and health clinics, personal trainers, fitness studios, yoga instructors, and other service businesses. Shared staff calendars keep availability in sync when one person offers several services. Easy Setup – Ready in 2 Minutes Watch how it works in action: Check out the live demo: https://wordpress.creavi.dk/booking/ We’re open to any suggestions! Feel free to reach out via the support forum — we’re happy to hear your ideas and may implement them in future updates. Free Features Included Creavi provides a complete, user-friendly booking setup for free, including calendar connections, automated reminders, flexible forms, video meetings, exports, and ready-made Gutenberg layouts. Add booking button anywhere via shortcode: [creavibc_booking_button id="123"] (opens booking popup) Embed full booking interface directly on page via shortcode: [creavibc_booking_inline id="123"] Service Catalogs for online appointment booking: Build a simple service list or organize services into categories Show optional images and custom labels on responsive service cards Let customers select a service and compare one or more providers’ available times Use each service’s appointment duration when showing bookable time slots Share a staff calendar across services so one booking blocks overlapping times Add the catalog to any page with its shortcode Support multiple booking widgets on the same page (different services) Smooth booking experience: Popup or inline layout Step-by-step flow: Date → Time → Details Clean, customizable calendar design with a live admin preview A five-column desktop time-slot grid with compact inline AM/PM labels Fixed slot and action-button dimensions that stay consistent across themes and page builders Website-font inheritance with protected calendar and form typography metrics Optional start-time-only summaries and confirmation emails Per-service 12-hour (3:00 PM) or 24-hour (15:00) time display Fully responsive and mobile-friendly Flexible availability settings: Admin-defined available days via date picker Rolling availability window measured in days or months (e.g. today plus the next 3 days) Exclude specific dates (days off, holidays) Minimum booking notice before an appointment can start Optional 5–60 minute buffer between appointments and connected calendar events Live admin availability grid that updates when the appointment duration or buffer changes Flexible weekday-based time slots: Visual grid selector (e.g. Mon 9:00, Tue 10:30) Different time slots per weekday Optional slot duration: 10 / 15 / 20 / 30 / 60 / 90 minutes Dynamic time slots based on selected date Smart timezone handling: Admin timezone detection Timezone modes: Localized (auto-adjust to user timezone) Locked (fixed business timezone) Clear timezone indication on frontend Customizable booking form fields: Editable Name, Email, and Phone default fields Include or hide each default field and choose whether it is required Add custom Text, Textarea, Telephone, Number, and Date fields Correct required-field validation for dates and all other supported field types Light, readable required-field hints that use the service accent color Edit consent text and privacy-policy links Add as many custom fields as needed Automated email notifications & reminders: Sent to both admin and customer Safe visual HTML editor with media support and plain-text fallback Dynamic tags: {name}, {email}, {phone}, {date}, {time}, {service} Optional reminder emails before the appointment (reduce no-shows) Google Calendar integration: Automatically push bookings to Google Calendar Block already booked time slots from Google Calendar Google Calendar link generation for attendees Custom Google event title and description templates Outlook Calendar integration: Automatically push bookings to Outlook Calendar Per-service Outlook connection and sync Block busy Outlook time slots on the frontend Custom Outlook event title and description templates Calendar & scheduling: Downloadable .ics (iCalendar) file Per-service calendar language and localized date summaries 67 explicit language and regional calendar choices, plus the website default Automatic cleanup of completed booking records after a preset or custom retention period Choose whether eligible records move to Trash or are deleted permanently Booking management and exports: Select bookings in All Bookings and export them to CSV or Excel Exported columns include customer, service, date, time, meeting, and custom-field data CSV files are ready to open or import into Google Sheets Booking REST API for approved tools and AI assistants: Create a restricted connection from one settings page without logging out or manually creating a WordPress user Choose permissions and expiration separately for every connection List today’s bookings or an inclusive date range, with pagination and optional service filtering Rotate or revoke credentials and inspect when each connection was last used Download a ready-to-import Postman collection Optional MCP connections for compatible AI assistants: Give site owners restricted access to booking tools Share selected services with customers through a public booking link, with a review step before confirmation Meeting & location options: In-person meetings Online meetings (video or custom link) Phone call option Built-in video conferencing: Free automatic meeting link generation Personalization options: Custom brand color Personalized thank-you message Clear booking management with no plugin-imposed service or booking limits Beautiful, aligned admin UI designed for fast setup Works with Gutenberg, Elementor, and other page builders Gutenberg Booking Profile labels follow the connected service, so each booking step and button can be translated per service Multilingual & Translation Ready Languages This plugin is fully translation-ready and supports localization via translate.wordpress.org. Bundled plugin-interface translations include: * English (default) * French * Danish The customer-facing calendar can follow the website language or use one of 67 explicit language and regional choices. This localizes month names, weekdays, selected-date summaries, and confirmation dates without loading a separate Flatpickr language file for every choice. You can help translate this plugin into your language at: https://translate.wordpress.org/projects/wp-plugins/creavi-booking-service/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C