WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting

WordPress Advanced Booking Calendar plugin before 1.7.1 contains a cross-site scripting vulnerability. It does not sanitize and escape the room parameter before outputting it back in an admin page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of th...

WordPress Booking Calendar <3.2.2 - Arbitrary File Upload

WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify...

CVE-2026-105195

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site...

CVE-2026-105193

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

CVE-2026-105193

The Booking Calendar WordPress plugin, in versions before 11.8 , is vulnerable to unauthenticated booking information disclosure and modification. The root cause is the use of insufficient entropy when generating per-booking access hashes, as they are derived from a low-entropy time-seeded value ...

EUVD-2026-94765

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

CVE-2026-105193 Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

EUVD-2026-94767

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site...

CVE-2026-105195

The Booking Calendar WordPress plugin (versions 10.15 - 11.8.2 ) contains a vulnerability where it fails to adequately restrict which options a lower-privileged user can load through one of its settings handlers . This flaw allows users with the Editor role and above to disclose the values of arb...

WordPress Booking Calendar plugin 10.15-11.8.2 - Editor+ Arbitrary Option Disclosure vulnerability

Editor+ Arbitrary Option Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Booking Calendar versions 10.15-11.8.2...

WordPress Booking Calendar plugin < 11.8 - Unauthenticated Booking Information Disclosure and Modification vulnerability

Unauthenticated Booking Information Disclosure and Modification vulnerability discovered by Olaf Schigt in WordPress Plugin Booking Calendar versions 11.8...

CVE-2026-105195 Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site...

PT-2026-107834

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site...

PT-2026-107832

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

CVE-2024-1207

Booking Calendar = 9.9 - Injection SQL non authentifiée CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent: Mozilla/5.0...

CVE-2026-39764

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services = 1.0.19 versions...

CVE-2026-39764 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services = 1.0.19 versions...

CVE-2026-39764

The Radius Booking — Booking Calendar for Appointments & Services WordPress plugin (versions

CVE-2026-39764 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services = 1.0.19 versions...

WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Pedro "TheZakMan" Araujo in WordPress Plugin Radius Booking — Booking Calendar for Appointments & Services versions = 1.0.19...