Wpdevelop - vulnerabilities (CVEs)

30 CVEs in 3 products, 2 in the last 30 days, newest from 2026-10-10.

Products

Newest CVEs of Wpdevelop

CVE-2026-18496 - CVSS 5.3 (medium), 2026-10-10: The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the…
CVE-2026-39601 - CVSS 3.7 (low), 2026-10-02: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows…
CVE-2026-93655 - CVSS 6.1 (medium), 2026-09-22: The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and…
CVE-2026-92561 - CVSS 6.1 (medium), 2026-09-18: The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including,…
CVE-2026-92619 - CVSS 7.2 (high), 2026-09-18: The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save`…
CVE-2026-74002 - CVSS 5.3 (medium), 2026-09-17: Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
CVE-2026-59558 - CVSS 7.1 (high), 2026-07-27: Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.
CVE-2026-42751 - CVSS 6.5 (medium), 2026-05-27: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored…
CVE-2026-32358 - CVSS 7.6 (high), 2026-03-13: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL…
CVE-2026-2230 - CVSS 4.3 (medium), 2026-02-18: The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the…
CVE-2026-1431 - CVSS 5.3 (medium), 2026-01-31: The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the…
CVE-2025-14982 - CVSS 4.3 (medium), 2026-01-16: The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and…
CVE-2025-14146 - CVSS 5.3 (medium), 2026-01-09: The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the…
CVE-2025-14383 - CVSS 7.5 (high), 2025-12-15: The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and…
CVE-2025-12804 - CVSS 6.4 (medium), 2025-12-05: The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bookingcalendar' shortcode in all versions up to, and…
CVE-2025-64381 - CVSS 6.5 (medium), 2025-11-13: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Calendar booking allows Stored…
CVE-2025-64275 - CVSS 6.5 (medium), 2025-11-13: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored…
CVE-2025-9346 - CVSS 6.4 (medium), 2025-08-28: The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to…
CVE-2025-4669 - CVSS 6.4 (medium), 2025-05-17: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and…
CVE-2024-13821 - CVSS 5.3 (medium), 2025-02-12: The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including,…
CVE-2024-13323 - CVSS 6.4 (medium), 2025-01-14: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and…
CVE-2024-56292 - CVSS 5.9 (medium), 2025-01-07: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Email Reminders email-reminders allows Stored…
CVE-2024-11945 - CVSS 6.4 (medium), 2024-12-10: The Email Reminders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.4 due…
CVE-2024-9306 - CVSS 4.8 (medium), 2024-10-04: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to…
CVE-2024-8274 - CVSS 6.1 (medium), 2024-08-30: The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to,…
CVE-2024-6930 - CVSS 6.4 (medium), 2024-07-24: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode…
CVE-2024-1207 - CVSS 9.8 (critical), 2024-02-08: The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up…
CVE-2022-1463 - CVSS 8.8 (high), 2022-05-10: The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1.…
CVE-2017-2151 - CVSS 6.1 (medium), 2017-04-28: Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified…
CVE-2017-2150 - CVSS 5.3 (medium), 2017-04-28: Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted…