CVE-2024-8274

CVE-2024-8274 affects the WP Booking Calendar WordPress plugin (all versions up to 10.5). The vulnerability is a Reflected XSS via parameters in timeline_obj caused by insufficient input sanitization and output escaping. It allows unauthenticated attackers to inject scripts into pages that execut...

CVE-2024-9306

The CVE refers to WP Booking Calendar for WordPress (versions

CVE-2024-13323

Stored XSS in WP Booking Calendar (WordPress) via the booking shortcode due to insufficient input sanitization/output escaping. Affected all versions up to 10.9.2; exploitation requires contributor-level authentication; remediation status indicated as patched in connected sources.

CVE-2024-10893

The CVE-2024-10893 issue affects the WordPress WP Booking Calendar plugin prior to version 10.6.5. The root cause is that the plugin does not sanitise and escape some settings, enabling Stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disabled (e.g., multisite). Pub...

CVE-2024-10027

The CVE-2024-10027 entry concerns the WP Booking Calendar WordPress plugin. Affected: WP Booking Calendar WordPress plugin versions prior to 10.6.3. Root cause: the plugin does not sanitize and escape certain Widgets settings, enabling Stored XSS. Impact: can allow high-privilege users (e.g., Adm...

CVE-2025-4669

CVE-2025-4669 affects WP Booking Calendar (WordPress) up to and including version 10.11.1, due to insufficient input sanitization and output escaping on the wpbc shortcode attributes. The issue enables stored XSS for authenticated users with contributor-level access and above, potentially executi...