1252 matches found
WordPress Booking Calendar <3.2.2 - Arbitrary File Upload
WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify...
WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting
WordPress Advanced Booking Calendar plugin before 1.7.1 contains a cross-site scripting vulnerability. It does not sanitize and escape the room parameter before outputting it back in an admin page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of th...
WordPress Booking Calendar plugin <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter vulnerability
Authenticated Editor+ Privilege Escalation to 'dataname' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin Booking Calendar versions = 11.8.2...
CVE-2026-92561
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2026-92619
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the wpbcajaxoptionsave AJAX action. The vulnerability exists because the handleajaxsave function applies per-option safeguards only to names explicitly registered via...
EUVD-2026-82734
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2026-92561 Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2026-92561
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'options' parameter in all versions up to and including 11.8.2 . The root cause is insufficient input sanitization and output escaping in the timeline v2 component (wpbc-class-timeline_v2.php)....
CVE-2026-92619 Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the wpbcajaxoptionsave AJAX action. The vulnerability exists because the handleajaxsave function applies per-option safeguards only to names explicitly registered via...
EUVD-2026-82729
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the wpbcajaxoptionsave AJAX action. The vulnerability exists because the handleajaxsave function applies per-option safeguards only to names explicitly registered via...
CVE-2026-92619
The Booking Calendar plugin for WordPress (all versions up to 11.8.2 ) is vulnerable to Privilege Escalation via the wpbc_ajax_option_save AJAX action. The root cause is that handle_ajax_save() only enforces per-option safeguards for names registered via register_option_policy(); any unregistered...
CVE-2026-74002
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
CVE-2026-74002
CVE-2026-74002 is an unauthenticated Broken Access Control vulnerability in the WordPress Booking Calendar plugin , affecting versions 11.7 and earlier . The flaw was discovered by Ananda Dhakal via Patchstack and carries a CVSS 3.1 score of 5.3 (MEDIUM) , with low integrity impact and no impact ...
CVE-2026-74002 WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
EUVD-2026-81515
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Booking Calendar versions = 11.7...
CVE-2024-1207
Booking Calendar = 9.9 - Неаутентифицированная SQL-инъекция CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com...
WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Nguyen Anh Quan prototw in WordPress Plugin Amelia versions = 2.4.9...
WordPress Booktics - Booking Calendar for Appointments and Service Businesses plugin <= 1.0.23 - Missing Authorization vulnerability
WordPress Booktics - Booking Calendar for Appointments and Service Businesses plugin = 1.0.23 - Missing Authorization vulnerability discovered by revblock in WordPress Plugin Booktics versions = 1.0.23...