Booking Calendar vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

BC

Product

Booking Calendar

by wpdevelop · last CVE Oct 10, 2026

18

CVEs

0

On KEV

7.6

Max CVSS

2

New 30D

Vulnerabilities18 In the news0 Timeline

Severity mix

Critical 0High 4Medium 13Low 1

Severity

All severities18 Critical0 High4 Medium13 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Booking Calendar to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-64381	6.5	0%	Nov 13	WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability Affected: through 10.14.7
CVE-2025-12804	6.4	0%	Dec 5	Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode Affected: through 10.14.6
CVE-2025-9346	6.4	0%	Aug 28	Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 10.14.1
CVE-2026-93655	6.1	0%	Sep 22	Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter Affected: through 11.8.3
CVE-2026-92561	6.1	0%	Sep 18	Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter Affected: through 11.8.2
CVE-2025-4669	5.4	0%	May 17	Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode Affected: through 10.11.1
CVE-2026-18496	5.3	0%	Oct 10	Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action Affected: through 11.4.3
CVE-2026-74002	5.3	0%	Sep 17	WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability Affected: through 11.7
CVE-2026-1431	5.3	0%	Jan 31	Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure Affected: through 10.14.13
CVE-2025-14146	5.3	0%	Jan 9	Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure Affected: through 10.14.10
CVE-2024-13821	5.3	0%	Feb 12	WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation Affected: through 10.10
CVE-2026-2230	4.3	0%	Feb 18	Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification Affected: through 10.14.14
CVE-2025-14982	4.3	0%	Jan 16	Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure Affected: through 10.14.11