Extension WordPress
Vulnérabilités Booking calendar, Appointment Booking System
Cette page rassemble les failles publiées pour Booking calendar, Appointment Booking System, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Booking calendar, Appointment Booking System
20 fiches
Booking calendar, Appointment Booking System <= 3.2.36 – Missing Authorization
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.2.36. This makes it possible for unauthenticated attackers to…
*-3.2.36
Non indiqué
02/07/2026
Booking calendar, Appointment Booking System <= 3.2.36 – Unauthenticated Stored Cross-Site Scripting
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.36 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
*-3.2.36
Non indiqué
18/03/2026
Booking calendar, Appointment Booking System <= 3.2.30 – Missing Authorization
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.2.30. This makes it possible for unauthenticated attackers…
*-3.2.30
3.2.31
15/12/2025
Booking calendar, Appointment Booking System <= 3.2.17 – Unauthenticated Time-Based SQL Injection via 'wpdevart_id'
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevart_id’ parameter in all versions up to, and including, 3.2.17 due to insufficient escaping on the user supplied parameter and lack…
*-3.2.17
3.2.18
01/07/2025
Booking Calendar and Booking Calendar Pro <= Multiple Versions – Reflected Cross-Site Scripting via 'calendar_id'
The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output…
*-3.2.19
3.2.20
06/01/2025
Booking Calendar WpDevArt <= 3.2.19 – Authenticated (Contributor+) SQL Injection
The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of…
*-3.2.19
3.2.20
23/12/2024
Booking calendar, Appointment Booking System <= 3.2.15 – Unauthenticated Stored Cross-Site Scripting via SVG File Upload
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it…
*-3.2.15
3.2.16
25/11/2024
Booking calendar, Appointment Booking System <= 3.2.3 – Missing Authorization
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.2.3. This makes it possible for authenticated attackers,…
*-3.2.3
3.2.4
27/01/2024
Booking Calendar WpDevArt <= 3.2.11 – Authenticated (Admin+) SQL Injection
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to SQL Injection via the '$email_address' variable in all versions up to, and including, 3.2.11 due to insufficient escaping on the user supplied parameter and lack of…
*-3.2.11
3.2.12
29/10/2023
Booking calendar, Appointment Booking System <= 3.2.8 – Multiple Authenticated(Editor+) SQL Injection
The Booking calendar plugin for WordPress is vulnerable to SQL Injection via the search functionality on multiple administrative pages in versions up to, and including, 3.2.8 due to insufficient escaping on the user supplied parameters and lack of…
[*, 3.2.9)
3.2.9
12/09/2023
Booking calendar, Appointment Booking System <= 3.2.6 – Authenticated (Administrator+) SQL Injection via *_selected
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to generic SQL Injection via the multiple *_selected functions in versions up to, and including, 3.2.6 due to insufficient escaping on the user supplied parameter and lack…
*-3.2.6
3.2.7
19/04/2023
Booking calendar, Appointment Booking System <= 3.2.3 – Unauthenticated Bypass Vulnerability
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to a bypass in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to bypass controls. It is unclear from the original…
*-3.2.3
3.2.4
27/01/2023
Booking calendar, Appointment Booking System <= 3.2.3 – Cross-Site Request Forgery
The Booking calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation when creating, editing, duplicating and deleting bookings. This makes it…
*-3.2.3
3.2.4
27/01/2023
Booking calendar, Appointment Booking System <= 3.2.3 – Authenticated (Editor+) Stored Cross-Site Scripting
The Booking calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
*-3.2.3
3.2.4
27/01/2023
Booking calendar, Appointment Booking System <= 3.2.1 – Unauthenticated Arbitrary File Upload
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the save_reserv function in versions up to, and including, 3.2.1. This makes it possible for unauthenticated…
*-3.2.1
3.2.2
21/11/2022
Booking calendar, Appointment Booking System < 2.2.3 – Unauthenticated Parameter Manipulation
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin in versions up to, and including, 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
*-2.2.2
2.2.3
07/06/2018
Booking calendar, Appointment Booking System <= 2.1.7 – Cross-Site Request Forgery
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.
[*, 2.1.8)
2.1.8
12/01/2018
Booking calendar, Appointment Booking System <= 2.1.7 – Cross-Site Scripting
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.
[*, 2.1.8)
2.1.8
11/01/2018
Booking calendar, Appointment Booking System <= 2.1.7 – Cross-Site Scripting
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.
[*, 2.1.8)
2.1.8
11/01/2018
Booking calendar, Appointment Booking System <= 2.1.7 – Cross-Site Scripting
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.
[*, 2.1.8)
2.1.8
11/01/2018
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.