Booking Calendar
Approved changes feed: RSS · Atom
cpe:2.3:a:booking_calendar_project:booking_calendar:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Booking Calendar Project (c8e657ab-c3c9-5d11-99f8-f3da537b660c) |
|---|---|
| Product | Booking Calendar (667a40a9-4db3-56b8-b5ac-a82124551627) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wp-plugins/booking |
purl2cpe | 2026-10-12 21:12:00.113604 |
pkg:github/wpplugins/booking |
purl2cpe | 2026-10-12 21:12:00.113606 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-36384 |
vulnerable | 2026-06-08 06:08:11.242379 |
WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)
HIGH (7.1)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions.
Published: 2023-07-18T14:17:40.116Z
Updated: 2026-04-28T16:08:31.402Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1463 |
vulnerable | 2026-06-08 05:39:13.192046 |
Booking Calendar <= 9.1 - PHP Object Injection via Shortcode
HIGH (8.8)
The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.
Published: 2022-05-10T19:37:41.000Z
Updated: 2025-02-13T20:42:52.167Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25040 |
vulnerable | 2026-06-08 05:30:39.849861 |
Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Published: 2022-01-03T12:49:18.000Z
Updated: 2024-08-03T19:49:14.581Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-2151 |
vulnerable | 2026-06-08 05:09:23.704434 |
Details available
Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published: 2017-04-28T16:00:00.000Z
Updated: 2024-08-05T13:48:03.509Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-2150 |
vulnerable | 2026-06-08 05:09:23.704025 |
Details available
Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.
Published: 2017-04-28T16:00:00.000Z
Updated: 2024-08-05T13:48:03.531Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.