CVE-2022-1463

The CVE-2022-1463 is tied to the WordPress Booking Calendar plugin (≤ 9.1). The vulnerability is an insecure deserialization/PHP Object Injection via the [bookingflextimeline] shortcode, allowing an attacker with subscriber-level privileges or higher to trigger arbitrary PHP object instantiation ...

CVE-2018-20556

CVE-2018-20556 is a SQL injection vulnerability in the WordPress plugin Booking Calendar (version 8.4.3). The flaw allows an attacker to manipulate the booking_id parameter to execute arbitrary SQL commands on the underlying database, potentially exposing data. Multiple connected sources corrobor...

CVE-2023-36384

CVE-2023-36384 affects the Booking Calendar Contact Form WordPress plugin, vulnerable in versions

CVE-2021-25040

The Booking Calendar WordPress plugin (versions before 8.9.2) contains a Reflected Cross-Site Scripting vulnerability in the booking_type parameter, which is not sanitised or escaped before being output on an admin page. Root cause: inadequate input sanitisation/escaping. Public exploit evidence ...

CVE-2018-5671

CVE-2018-5671 affects the WordPress plugin booking-calendar 2.1.7 . The issue is a stored XSS vulnerability exploitable via the request parameter wp-admin/admin.php?extra_field1[items][field_item1][price_percent] . The available sources describe the vulnerability path but do not provide specific ...

CVE-2018-5673

The CVE-2018-5673 entry concerns the WordPress Booking Calendar plugin prior to v2.1.8, where a CSRF vulnerability exists in wp-admin/admin.php for plugin 2.1.7. The NVD entry records CSRF with CVSS v2 base 6.8 (Medium) and CVSS v3 base 8.8 (High). Connected sources also describe an authenticated...

CVE-2017-2150

The CVE-2017-2150 entry concerns the WordPress plugin Booking Calendar (versions 7.0 and earlier). Affected component: the Booking Calendar plugin’s captcha_chalange handling. Root cause: directory traversal vulnerability that enables a remote attacker to read arbitrary files by crafting the inpu...

CVE-2018-5670

CVE-2018-5670 affects the WordPress booking-calendar plugin up to version 2.1.7. The issue is an XSS in wp-admin/admin.php via the sale_conditions[count][] parameter, as reported across sources (NVD, CNVD, CVE listings). Some records describe this as an authenticated stored XSS with CSRF (WPVulnd...

CVE-2018-5672

CVE-2018-5672 affects the WordPress booking-calendar plugin, version 2.1.7. It exposes a stored XSS via the wp-admin/admin.php form_field5[label] parameter, as described across CNVD/NVD entries. Exploitation could allow an attacker to obtain a user cookie or perform a malicious action; the inform...

CVE-2017-2151

The CVE-2017-2151 entry concerns the WordPress plugin Booking Calendar (versions 7.1 and earlier). The vulnerability is a stored cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML/script via unspecified vectors, potentially executing in a user’s browser. Affecte...