CVE-2016-20070: Improper Neutralization of Input During Web Page Generation

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with...

CVE-2016-20068: Improper Neutralization of Special Elements used in an SQL Command

WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint wit...

CVE-2016-20069: Improper Neutralization of Special Elements used in an SQL Command

WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to...

CVE-2026-6810: Authorization Bypass Through User-Controlled Key

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dexbccfadminintcalendarlist.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2025-13318: Missing Authorization

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the dexbccfcheckIPNverification function. This makes it possible for unauthenticated...

EUVD-2025-19983

Malicious code in bioql PyPI...

EUVD-2023-29016

Malicious code in bioql PyPI...

CVE-2025-48231: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through = 1.2.58...

CVE-2016-10908

The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS...

CVE-2025-24723 WordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodePeople Booking Calendar Contact Form allows Stored XSS. This issue affects Booking Calendar Contact Form: from n/a through 1.2.55...

CVE-2025-24723

CVE-2025-24723 is a stored XSS in CodePeople Booking Calendar Contact Form. Affected: Booking Calendar Contact Form plugin up to version 1.2.55. Root cause: improper input neutralization during web page generation. Impact: stored cross-site scripting could affect site users. Public details confir...

CVE-2025-24723: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through = 1.2.55...

CVE-2023-25037: Missing Authorization

Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodePeople Booking Calendar Contact Form plugin = 1.2.40 versions...

Booking Calendar Contact Form < 1.2.41 - Unauthenticated Reflected Cross-Site Scripting

Description Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodePeople Booking Calendar Contact Form plugin = 1.2.40 versions...

PT-2023-25565

Name of the Vulnerable Software and Affected Versions CodePeople Booking Calendar Contact Form plugin versions 1.2.40 and earlier Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the execution of malicious scripts on th...

CVE-2023-36384: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodePeople Booking Calendar Contact Form plugin = 1.2.40 versions...

WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Contact Form Type Plugin Vulnerable versions = 1.2.40 Fixed in 1.2.41 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36384 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5ffa418dea78 Credits B...

WordPress Booking Calendar Contact Form Plugin <= 1.2.34 is vulnerable to Broken Access Control

Software Booking Calendar Contact Form Type Plugin Vulnerable versions = 1.2.34 Fixed in 1.2.35 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25037 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 1c56c1a6fa83 Credits István...

CVE-2016-10909

The CVE-2016-10909 entry concerns the WordPress Booking Calendar Contact Form plugin prior to 1.0.24, which is vulnerable to SQL Injection due to an input handling flaw in that plugin version. The issue is documented consistently across multiple sources (NVD, Red Hat, CVE registries, CNVD, PRION,...