HomeWordPress vulnerabilitiesBooking Calendar
Booking Calendar vulnerabilities
Booking Calendar has 23 known vulnerabilities in this database. The most recent published record is dated 2 Oct 2026.
- Known vulnerabilities
- 23
- Active installs
- 40,000+
- Latest version
- 11.8.4
- Last updated
- 19 Sep 2026
- Most recent
- 2 Oct 2026
No fixed version has been published yet, so consider disabling, removing or replacing the plugin until a safe release is available.
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Security weakness CVE-2026-39601 | Low 3.7 | Up to 11.8.4 | No fixed version yet | 5 d ago |
| Cross-site scripting (XSS) CVE-2026-93655 | Medium 6.1 | Up to 11.8.3 | Fixed in a later version (latest 11.8.4) | 22 Sep 2026 |
| Cross-site scripting (XSS) CVE-2026-92561 | Medium 6.1 | Up to 11.8.2 | Fixed in a later version (latest 11.8.4) | 18 Sep 2026 |
| Privilege escalation CVE-2026-92619 | High 7.2 | Up to 11.8.2 | Fixed in a later version (latest 11.8.4) | 18 Sep 2026 |
| Broken access control CVE-2026-2230 | Medium 4.3 | Up to 10.14.14 | Fixed in a later version (latest 11.8.4) | 18 Feb 2026 |
| Broken access control CVE-2026-1431 | Medium 5.3 | Up to 10.14.13 | Fixed in a later version (latest 11.8.4) | 31 Jan 2026 |
| Broken access control CVE-2025-14982 | Medium 4.3 | Up to 10.14.11 | Fixed in a later version (latest 11.8.4) | 16 Jan 2026 |
| Sensitive data exposure CVE-2025-14146 | Medium 5.3 | Up to 10.14.10 | Fixed in a later version (latest 11.8.4) | 9 Jan 2026 |
| SQL injection CVE-2025-14383 | High 7.5 | Up to 10.14.8 | Fixed in a later version (latest 11.8.4) | 15 Dec 2025 |
| Cross-site scripting (XSS) CVE-2025-12804 | Medium 6.4 | Up to 10.14.6 | Fixed in a later version (latest 11.8.4) | 5 Dec 2025 |
| Cross-site scripting (XSS) CVE-2025-9346 | Medium 6.4 | Up to 10.14.1 | Fixed in a later version (latest 11.8.4) | 28 Aug 2025 |
| Cross-site scripting (XSS) CVE-2025-4669 | Medium 6.4 | Up to 10.11.1 | Fixed in a later version (latest 11.8.4) | 17 May 2025 |
| Cross-site scripting (XSS) CVE-2024-13323 | Medium 6.4 | Before 10.9.3 | Fixed in 10.9.3 | 14 Jan 2025 |
| Cross-site scripting (XSS) CVE-2024-8274 | Medium 6.1 | Before 10.5.1 | Fixed in 10.5.1 | 30 Aug 2024 |
| Cross-site scripting (XSS) CVE-2024-6930 | Medium 6.4 | Before 10.2.2 | Fixed in 10.2.2 | 24 Jul 2024 |
| Cross-site scripting (XSS) CVE-2023-4620 | Medium 6.1 | Before 9.7.3.1 | Fixed in 9.7.3.1 | 16 Oct 2023 |
| Cross-site request forgery (CSRF) CVE-2022-33177 | Medium 5.4 | Up to 9.2.1 | Fixed in a later version (latest 11.8.4) | 6 Sep 2022 |
| PHP object injection CVE-2022-1463 | High 8.8 | Up to 9.1 | Fixed in a later version (latest 11.8.4) | 10 May 2022 |
| Cross-site scripting (XSS) CVE-2021-25040 | Medium 6.1 | Before 8.9.2 | Fixed in 8.9.2 | 3 Jan 2022 |
| Cross-site scripting (XSS) CVE-2018-5671 | Medium 4.8 | Not yet published | Check for an update | 13 Jan 2018 |
| Cross-site scripting (XSS) CVE-2018-5672 | Medium 4.8 | Not yet published | Check for an update | 13 Jan 2018 |
| Cross-site request forgery (CSRF) CVE-2018-5673 | High 8.8 | Not yet published | Check for an update | 13 Jan 2018 |
| Cross-site scripting (XSS) CVE-2018-5670 | Medium 4.8 | Not yet published | Check for an update | 13 Jan 2018 |
Read the published descriptions
- CVE-2026-39601, 2 Oct 2026
- Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4. CVE record
- CVE-2026-93655, 22 Sep 2026
- The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE record
- CVE-2026-92561, 18 Sep 2026
- The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification. CVE record
- CVE-2026-92619, 18 Sep 2026
- The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy - bypassing all can_save, force_mode, and allowed_keys checks - for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via `admin-ajax.php?action=rest-nonce`. CVE record
- CVE-2026-2230, 18 Feb 2026
- The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by an Administrator, to modify other users' plugin settings, such as booking calendar display options, which can disrupt the booking calendar functionality for the targeted user. CVE record
- CVE-2026-1431, 31 Jan 2026
- The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails. CVE record
- CVE-2025-14982, 16 Jan 2026
- The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the database, including personally identifiable information (PII) such as names, email addresses, phone numbers, physical addresses, payment status, booking costs, and booking hashes belonging to other users. CVE record
- CVE-2025-14146, 9 Jan 2026
- The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action. This is due to the nonce verification being conditionally disabled by default (`booking_is_nonce_at_front_end` option is `'Off'` by default). When the `booking_is_show_popover_in_timeline_front_end` option is enabled (which is the default in demo installations and can be enabled by administrators), it is possible for unauthenticated attackers to extract sensitive booking data including customer names, email addresses, phone numbers, and booking details. CVE record
- CVE-2025-14383, 15 Dec 2025
- The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2025-12804, 5 Dec 2025
- The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bookingcalendar' shortcode in all versions up to, and including, 10.14.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2025-9346, 28 Aug 2025
- The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2025-4669, 17 May 2025
- The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-13323, 14 Jan 2025
- The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-8274, 30 Aug 2024
- The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE record
- CVE-2024-6930, 24 Jul 2024
- The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2023-4620, 16 Oct 2023
- The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators CVE record
- CVE-2022-33177, 6 Sep 2022
- Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update. CVE record
- CVE-2022-1463, 10 May 2022
- The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site. CVE record
- CVE-2021-25040, 3 Jan 2022
- The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting CVE record
- CVE-2018-5671, 13 Jan 2018
- An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter. CVE record
- CVE-2018-5672, 13 Jan 2018
- An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter. CVE record
- CVE-2018-5673, 13 Jan 2018
- An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php. CVE record
- CVE-2018-5670, 13 Jan 2018
- An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter. CVE record
What to do if you run Booking Calendar
If you run Booking Calendar, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Booking Calendar vulnerabilities
Free. We email you when a new vulnerability is published for Booking Calendar, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.