Unknown Booking Calendar vulnerabilities

4 vulnerabilities

Known vulnerabilities in Unknown Booking Calendar, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2021-25040booking_calendar_projectbooking_calendar+2
EPSS score
0.80%
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting2.7CVE-2026-105195unknownbooking calendar+1
EPSS score
0.23%
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.5.3CVE-2026-105193unknownbooking calendar+1
EPSS score
0.12%
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.6.5CVE-2023-4620unknownbooking calendar+2
EPSS score
0.56%
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators