WP Booking Calendar, PSC-2026-64650

PSC, Research URL: PSC-2026-64650
Home page URL: Security reports for WP Booking Calendar
Application: WP Booking Calendar
Published on: Apr 28, 2026
Research Description: Booking and reservation plugins operate across a sensitive boundary between public form submission, calendar availability, customer-provided booking data, admin-side reservation management, and in some configurations external calendar synchronization. These plugins often process names, contact details, selected dates, time slots, service requests, event information, and notification templates, while also controlling whether a date or resource can be booked. A weakness in this class of plugin can lead to stored XSS through booking fields, unauthorized booking manipulation, information disclosure through request listings, CSRF against administrators, double-booking logic abuse, or unsafe synchronization behavior. Booking Calendar version 10.15.6 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64650, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for booking, appointment, reservation, calendar, and form-management plugins.
Affected versions: Min 11.8.4, max 11.8.4.
Status: SAFE & CERTIFIED