WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Booking Calendar Contact Form

Booking calendar form with a start and end date, or a single date option. Perfect for hotels, houses, services. PayPal payment integration included.

11Reported vulnerabilities
9.8Highest CVSS score
1.2.67Latest version
500+Active installs

What to do now

Update Booking Calendar Contact Form to 1.1.25 or later. 11 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 17, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2016-10909 Critical 9.8 1.8% Before 1.0.24 1.0.24 August 21, 2019
CVE-2016-20068 High 8.1 0.3% 1.0.23 and earlier 1.0.24 February 8, 2016
CVE-2016-20084 High 7.2 0.2% 1.1.24 and earlier 1.1.25 June 15, 2026
CVE-2016-20070 Medium 6.4 0.2% 1.0.23 and earlier 1.0.24 June 15, 2026
CVE-2025-48231 Medium 6.4 0.2% 1.2.58 and earlier 1.2.59 June 30, 2025
CVE-2016-10908 Medium 6.1 0.9% Before 1.0.24 1.0.24 August 21, 2019
CVE-2023-36384 Medium 6.1 0.4% 1.2.40 and earlier 1.2.41 June 22, 2023
CVE-2026-6810 Medium 5.3 0.3% 0 to 1.2.63 (inclusive) 1.2.64 April 24, 2026
CVE-2025-13318 Medium 5.3 0.3% 0 to 1.2.60 (inclusive) 1.2.61 November 22, 2025
CVE-2025-24723 Medium 4.4 0.3% 1.2.55 and earlier 1.2.56 January 24, 2025
CVE-2023-25037 Medium 4.3 0.5% 1.2.34 and earlier 1.2.35 February 6, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.