CVE-2026-116557

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

CVE-2026-116557

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized data modification in versions up to and including 2.1.0.5 . The root cause is a missing capability check within the wpbs_action_ajax_calendar_remove_note() function. This flaw allows authenticated attacker...

CVE-2026-116557 WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

EUVD-2026-114610

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

CVE-2026-116557 WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

PT-2026-134452

Name of the Vulnerable Software and Affected Versions WP Booking System - Booking Calendar plugin for WordPress versions prior to 2.1.0.6 Description An authorization flaw exists where a missing capability check in the wpbs action ajax calendar remove note function allows authenticated users with...

CVE-2024-37396

A stored cross-site scripting XSS vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the...

CVE-2024-37396

A stored cross-site scripting XSS vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the...

CVE-2024-56313

A stored cross-site scripting XSS vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the Notes field of a calendar event. When the event is viewed, the crafted payload is executed, potentially enabling the execution of...

CVE-2024-56311

REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery CSRF attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This...

REDCap security vulnerabilities

REDCap is a data collection and management web application from the REDCap open source. A security vulnerability exists in REDCap 15.0.0 and earlier versions, which stems from a failure to effectively secure the input content of the Notes field of Calendar, making it susceptible to a stored...

CVE-2016-3541

Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to Notes...