WWPdevelop

Products

Exploited and recent CVEs

• CVE-2026-18496 Medium 5.3 Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action 0.2%
• CVE-2026-39601 Low 3.7 WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability 0.2%
• CVE-2026-93655 Medium 6.1 Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter 0.4%
• CVE-2026-92561 Medium 6.1 Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter 0.4%
• CVE-2026-92619 High 7.2 Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter 0.7%
• CVE-2026-74002 Medium 5.3 WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability 0.3%
• CVE-2026-59558 High 7.1 WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2026-42751 Medium 6.5 WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability 0.1%
• CVE-2026-32358 High 7.6 WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability 0.3%
• CVE-2026-2230 Medium 4.3 Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification 0.2%
• CVE-2026-1431 Medium 5.3 Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure 0.3%
• CVE-2025-14982 Medium 4.3 Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure 0.4%
• CVE-2025-14146 Medium 5.3 Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure 0.4%
• CVE-2025-14383 High 7.5 Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check 0.4%
• CVE-2025-12804 Medium 6.4 Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode 0.2%
• CVE-2025-64381 Medium 6.5 WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2025-64275 Medium 6.5 WordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2025-9346 Medium 6.4 Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
• CVE-2025-4669 Medium 6.4 Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode 0.4%
• CVE-2024-13821 Medium 5.3 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation 0.4%
• CVE-2024-13323 Medium 6.4 Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode 0.4%
• CVE-2024-56292 Medium 5.9 WordPress Email Reminders Plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2024-11945 Medium 6.4 Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter 0.4%
• CVE-2024-9306 Medium 4.4 WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting 0.3%
• CVE-2024-8274 Medium 6.1 WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting 0.5%
• CVE-2024-6930 Medium 6.4 WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode 0.3%
• CVE-2024-1207 Critical 9.8 Booking Calendar <= 9.9 - Unauthenticated SQL Injection 3.2%
• CVE-2022-1463 High 8.8 Booking Calendar <= 9.1 - PHP Object Injection via Shortcode 1.7%