Booking Calendar (Unknown) - vulnerabilities (CVEs)

6 CVEs, 2 in the last 30 days, 2 known versions, newest CVE from 2026-10-08. Vendor: Unknown.

CVEs of Booking Calendar

• CVE-2026-105195 - CVSS 2.7 (low), 2026-10-08: The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings…
• CVE-2026-105193 - CVSS 4.8 (medium), 2026-10-08: The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy…
• CVE-2026-14334 - CVSS 8.8 (high), 2026-08-19: The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated…
• CVE-2023-4620 - CVSS 6.1 (medium), 2023-10-16: The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform…
• CVE-2022-3982 - CVSS 9.8 (critical), 2022-12-12: The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to…
• CVE-2021-25040 - CVSS 6.1 (medium), 2022-01-03: The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading…