CVE-2026-14334

Booking calendar, Appointment Booking System WordPress plugin (≤ 3.2.36) fails to sanitize uploaded SVG files. Unauthenticated attackers can bypass the plugin's script-stripping, upload a malicious SVG, and execute arbitrary JavaScript when an administrator reviews the booking — a stored XSS vect...

EUVD-2026-62264

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

EUVD-2026-60801

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-8840

The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...

CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

CVE-2026-57778

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through = 3.2.36...

CVE-2026-57778

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through = 3.2.36...

CVE-2026-57778

CVE-2026-57778 affects the WordPress plugin Booking calendar, Appointment Booking System, specifically versions up to and including 3.2.36. The issue is described as Missing Authorization / Broken Access Control, arising from incorrectly configured access control security levels in the booking-ca...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

EUVD-2026-15726

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through = 3.2.36...

CVE-2026-25435

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through = 3.2.36...

CVE-2026-25435 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through = 3.2.36...

PT-2026-27946

Name of the Vulnerable Software and Affected Versions wpdevart Booking calendar, Appointment Booking System versions n/a through 3.2.36 Description The software contains a flaw related to improper handling of user-supplied data during web page creation, which could allow for cross-site scripting...

WordPress plugin Booking calendar, Appointment Booking System 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

CVE-2025-14939

A vulnerability was found in code-projects Online Appointment Booking System 1.0. Impacted is an unknown function of the file /admin/deletemanager.php. The manipulation of the argument managername results in sql injection. The attack may be performed from remote. The exploit has been made public...

PT-2025-52410

Name of the Vulnerable Software and Affected Versions Online Appointment Booking System version 1.0 Description A flaw exists in the Online Appointment Booking System that allows for SQL injection. The issue is located in the /admin/deletemanager.php file, specifically through manipulation of the...

EUVD-2025-201947

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through = 3.2.30...