Creavi Appointment Booking Calendar
Creavi Appointment Booking Calendar has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Creavi Appointment Booking Calendar has a vendor fix available, so running the current release closes it.
All of these findings were reported by Athiwat Tiprasaharn (Jitlada). Creavi Appointment Booking Calendar is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-1856Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
Read the full analysisVulnerability Records

Creavi Appointment Booking Calendar
Author
Creavi
Creavi Appointment Booking Calendar is a free WordPress appointment scheduling plugin with Google and Outlook availability sync, reliable customer and admin reminders, built-in video meetings. Create bookable services, define your availability, collect customer details, send confirmation emails, and let customers book online in a clean calendar flow. You can offer in-person meetings, phone calls, custom meeting links, or secure video meetings generated directly by the plugin. Build a polished booking page in minutes with drag-and-drop Gutenberg blocks. Add a ready-made Service Hero section, a Booking Profile layout, an inline booking calendar, or a popup booking button without designing everything from scratch. Creavi is built for consultants, coaches, clinics, salons, agencies, educators, and small service businesses that want a practical booking system without monthly booking software. Easy Setup – Ready in 2 Minutes Watch how it works in action: Check out the live demo: https://wordpress.creavi.dk/booking/ We’re open to any suggestions! Feel free to reach out via the support forum — we’re happy to hear your ideas and may implement them in future updates. Free Features Included Creavi gives small service businesses a complete booking setup for free, including calendar sync, automated reminders, custom booking forms, video meeting options, and ready-made Gutenberg booking page layouts. Add booking button anywhere via shortcode: [creavibc_booking_button id="123"] (opens booking popup) Embed full booking interface directly on page via shortcode: [creavibc_booking_inline id="123"] Support multiple booking widgets on the same page (different services) Smooth booking experience: Popup or inline layout Step-by-step flow: Date → Time → Details Fully responsive and mobile-friendly Flexible availability settings: Admin-defined available days via date picker Rolling availability range (e.g. next 30–365 days) Exclude specific dates (days off, holidays) Minimum booking notice before an appointment can start Optional 5–60 minute buffer between appointments and connected calendar events Live admin availability grid that updates when the appointment duration or buffer changes Flexible weekday-based time slots: Visual grid selector (e.g. Mon 9:00, Tue 10:30) Different time slots per weekday Optional slot duration: 20 / 30 / 60 minutes Dynamic time slots based on selected date Smart timezone handling: Admin timezone detection Timezone modes: Localized (auto-adjust to user timezone) Locked (fixed business timezone) Clear timezone indication on frontend Customizable booking form fields: Toggle default Name & Email fields Add unlimited custom fields (text or textarea) Set any field as required Automated email notifications & reminders: Sent to both admin and customer Dynamic tags: {name}, {email}, {date}, {time}, {service} Optional reminder emails before the appointment (reduce no-shows) Google Calendar integration: Automatically push bookings to Google Calendar Block already booked time slots from Google Calendar Google Calendar link generation for attendees Custom Google event title and description templates Outlook Calendar integration: Automatically push bookings to Outlook Calendar Per-service Outlook connection and sync Block busy Outlook time slots on the frontend Custom Outlook event title and description templates Calendar & scheduling: Downloadable .ics (iCalendar) file Automatic cleanup of completed booking records after a preset or custom retention period Choose whether eligible records move to Trash or are deleted permanently Meeting & location options: In-person meetings Online meetings (video or custom link) Phone call option Built-in video conferencing: Automatic meeting link generation Personalization options: Custom brand color Personalized thank-you message Easy booking management Clean and minimal admin UI Works with Gutenberg, Elementor, and other page builders Multilingual & Translation Ready Languages This plugin is fully translation-ready and supports localization via translate.wordpress.org. Available languages include: * English (default) * French * Danish You can help translate this plugin into your language at: https://translate.wordpress.org/projects/wp-plugins/creavi-booking-service/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C