WB
Product
WP Booking System – Booking Calendar
7
CVEs
0
On KEV
9.1
Max CVSS
6
New 30D
Severity mix
Critical 1High 1Medium 5Low 0
Watch
Add WP Booking System – Booking Calendar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116557 New | 9.1 | Oct 31 | WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action Affected: through 2.1.0.5 |
| CVE-2026-108123 | 7.5 | Oct 17 | WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action Affected: through 2.1.0.3 |
| CVE-2026-109369 | 6.8 | Oct 17 | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse Affected: through 2.1.0.3 |
| CVE-2026-109368 | 6.5 | Oct 17 | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action Affected: through 2.1.0.3 |
| CVE-2026-107712 | 6.5 | Oct 10 | WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter Affected: through 2.1.0.1 |
| CVE-2024-8797 | 6.1 | Sep 14 | WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting Affected: through 2.0.19.8 |
| CVE-2026-111178 | 4.9 | Oct 16 | WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter Affected: through 2.1.0.1 |
Showing 7