Booking calendar, Appointment Booking System vulnerabilities

Product

Booking calendar, Appointment Booking System

by wpdevart · last CVE Aug 18, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities12 In the news0 Timeline

Severity mix

Critical 2High 3Medium 7Low 0

Severity

All severities12 Critical2 High3 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Booking calendar, Appointment Booking System to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-24373	9.8	0%	Jun 3	WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability Affected: through 3.2.3
CVE-2022-47428	9.8	1%	Nov 6	WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection Affected: through 3.2.7
CVE-2023-24407	8.8	1%	Dec 9	WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability Affected: through 3.2.3
CVE-2024-9504	7.2	0%	Nov 26	Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload Affected: through 3.2.15
CVE-2026-25435	7.1	0%	Mar 25	WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability Affected: through 3.2.36
CVE-2026-73395	6.5	0%	Aug 18	WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability Affected: through 3.2.36
CVE-2024-10856	6.5	0%	Dec 24	Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection Affected: through 3.2.19
CVE-2024-12077	6.1	0%	Jan 7	Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' Affected: through 3.2.19
CVE-2026-15289	5.9	0%	Jul 10	Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id' Affected: through 3.2.17
CVE-2026-8840	5.3	1%	Aug 15	Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action Affected: through 3.2.36
CVE-2026-57778	5.3	0%	Jul 13	WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability Affected: through 3.2.36
CVE-2025-67574	5.3	0%	Dec 9	WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability Affected: through 3.2.30