Vulnerabilities and security researches forbooking booking

Direction: ascending

Jun 07, 2024

WP Booking Calendar # CVE-2022-1463

CVE, Research URL: CVE-2022-1463
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: May 11, 2022
Research Description: The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2017-2150

CVE, Research URL: CVE-2017-2150
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Apr 28, 2017
Research Description: Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2021-25040

CVE, Research URL: CVE-2021-25040
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Jan 03, 2022
Research Description: The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2018-20556

CVE, Research URL: CVE-2018-20556
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Mar 21, 2019
Research Description: SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id parameter.
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2022-33177

CVE, Research URL: CVE-2022-33177
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Sep 06, 2022
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update.
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2017-2151

CVE, Research URL: CVE-2017-2151
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Apr 28, 2017
Research Description: Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2023-4620

CVE, Research URL: CVE-2023-4620
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Oct 16, 2023
Research Description: The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2023-51520

CVE, Research URL: CVE-2023-51520
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Feb 01, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7.4.
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2024-1207

CVE, Research URL: CVE-2024-1207
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Feb 08, 2024
Research Description: The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: Min -, max -.
Status: vulnerable

WP Booking Calendar # CVE-2023-23991

CVE, Research URL: CVE-2023-23991
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Mar 26, 2024
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3.
Affected versions: Min -, max -.
Status: vulnerable

Jul 24, 2024

WP Booking Calendar # CVE-2024-6930

CVE, Research URL: CVE-2024-6930
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Jul 24, 2024
Research Description: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Aug 30, 2024

WP Booking Calendar # CVE-2024-8274

CVE, Research URL: CVE-2024-8274
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Aug 30, 2024
Research Description: The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: Min -, max -.
Status: vulnerable

Oct 04, 2024

WP Booking Calendar # CVE-2024-9306

CVE, Research URL: CVE-2024-9306
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Oct 04, 2024
Research Description: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. In addition, site administrators have the option to grant lower-level users with access to manage the plugin's settings which may extend this vulnerability to those users.
Affected versions: Min -, max -.
Status: vulnerable

Nov 08, 2024

WP Booking Calendar # CVE-2024-10027

CVE, Research URL: CVE-2024-10027
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Nov 07, 2024
Research Description: The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected versions: Min -, max -.
Status: vulnerable

Dec 06, 2024

WP Booking Calendar # CVE-2024-10893

CVE, Research URL: CVE-2024-10893
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Dec 03, 2024
Research Description: The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected versions: Min -, max -.
Status: vulnerable

Jan 15, 2025

WP Booking Calendar # CVE-2024-13323

CVE, Research URL: CVE-2024-13323
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Jan 14, 2025
Research Description: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Feb 15, 2025

WP Booking Calendar # CVE-2024-13821

CVE, Research URL: CVE-2024-13821
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: Feb 12, 2025
Research Description: The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This makes it possible for unauthenticated attackers to manipulate their confirmed bookings, even after they have been approved.
Affected versions: Min -, max -.
Status: vulnerable

May 18, 2025

WP Booking Calendar # CVE-2025-4669

CVE, Research URL: CVE-2025-4669
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Date: May 17, 2025
Research Description: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable