AB
Product
Appointment Booking Calendar
14
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 5Medium 5Low 0
Watch
Add Appointment Booking Calendar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-46247 | 9.8 | Apr 22 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This… Affected: before 1.3.93 |
| CVE-2016-10916 | 9.8 | Aug 22 | The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319 Affected: before 1.1.24 |
| CVE-2025-46241 | 8.8 | Apr 22 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking… Affected: before 1.3.93 |
| CVE-2024-0856 | 8.8 | Mar 20 | The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… Affected: before 1.3.83 |
| CVE-2022-43482 | 8.8 | Nov 18 | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress Affected: before 1.3.70 |
| CVE-2020-9372 | 7.8 | Mar 4 | The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then… Affected: before 1.3.35 |
| CVE-2024-12274 | 7.5 | Jan 13 | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily… Affected: before 1.1.23 |
| CVE-2026-111727 New | 6.4 | Oct 28 | Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter Affected: through 1.4.05 |
| CVE-2019-14791 | 6.1 | Aug 9 | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter Affected: 1.3.18 |
| CVE-2020-9371 | 4.8 | Mar 4 | Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress Affected: before 1.3.35 |
| CVE-2026-12113 | 4.3 | Jul 1 | Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure Affected: through 1.4.02 |
| CVE-2026-12111 | 4.3 | Jun 18 | Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter Affected: through 1.4.01 |
| CVE-2015-7320 | – | Sep 29 | Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress… Affected: through 1.1.7 |
| CVE-2015-7319 | – | Sep 29 | SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to… Affected: through 1.1.7 |
Showing 14