Stellarwp Bookit — Booking & Appointment Calendar vulnerabilities

3 vulnerabilities

Known vulnerabilities in Stellarwp Bookit — Booking & Appointment Calendar, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2025-12633stellarwpbookit — booking & appointment calendar+1
EPSS score
0.28%
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to connect their Stripe account and receive payments.6.3CVE-2022-49745starpluginseasy_age_verify+1239
EPSS score
0.44%
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.9.8CVE-2023-2834stellarwpbookit — booking & appointment calendar+2
EPSS score
1.91%
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.