Unknown Appointment Booking Calendar Plugin And Scheduling Plugin vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Appointment Booking Calendar Plugin And Scheduling Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2024-12274codepeopleappointment_booking_calendar+2
EPSS score
0.65%
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).7.5CVE-2026-76586unknownappointment booking calendar plugin and scheduling plugin+1
EPSS score
0.36%
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.8.1CVE-2026-12378unknownappointment booking calendar plugin and scheduling plugin+1
EPSS score
0.65%
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.