Known vulnerabilities in Booking Calendar
WP Booking Calendar plugin for full-day bookings, time-slot appointments, rentals & events. Accept bookings and inquiries with flexible contact forms
38Reported vulnerabilities
9.8Highest CVSS score
11.5Latest version
50,000+Active installs
What to do now
Update Booking Calendar to 11.5 or later.
38 of these have a fixed version available. Updating resolves them.
Reported vulnerabilities
| CVE | Severity | Exploit probability |
Affected versions | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2018-20556 | High | 18.9% | 8.4.3 to 8.4.3 (inclusive) | 8.4.4 |
March 21, 2019 |
| CVE-2022-1463 | High | 1.7% | 9.1 and earlier | 9.1.1 |
May 10, 2022 |
| CVE-2024-1207 | Critical | 3.2% | Before 9.9.1 | 9.9.1 |
February 8, 2024 |
| CVE-2023-4620 | Medium | 0.6% | Before 9.7.3.1 | 9.7.3.1 |
October 16, 2023 |
| CVE-2021-25040 | Medium | 0.8% | Before 8.9.2 | 8.9.2 |
January 3, 2022 |
| CVE-2024-10893 | Medium | 0.3% | Before 10.6.5 | 10.6.5 |
December 3, 2024 |
| CVE-2024-10027 | Medium | 0.4% | Before 10.6.3 | 10.6.3 |
November 7, 2024 |
| WF-6f36d866-aa94-478b-8b62-0906bc95e413 | High | — | Before 6.2.1 | 6.2.1 |
August 1, 2016 |
| WF-e865324e-a2a2-40fb-8c6a-a89317b59c8c | High | — | Before 6.2.1 | 6.2.1 |
August 1, 2016 |
| CVE-2025-14383 | High | 0.4% | 0 to 10.14.8 (inclusive) | 10.14.9 |
December 15, 2025 |
| CVE-2026-92619 | High | 0.7% | 0 to 11.8.2 (inclusive) | 11.8.3 |
September 18, 2026 |
| CVE-2026-59558 | High | 0.3% | 11.4.2 and earlier | 11.4.3 |
July 27, 2026 |
| WF-ef9d256b-9156-4172-8892-29a26beddb71 | High | — | Before 6.2.1 | 6.2.1 |
August 1, 2016 |
| CVE-2023-23991 | Medium | 0.5% | 9.4.2 and earlier | 9.4.3.1 |
January 20, 2023 |
| CVE-2023-51520 | Medium | 0.3% | Before 9.7.4 | 9.7.4 |
September 25, 2023 |
| CVE-2025-12804 | Medium | 0.2% | 0 to 10.14.6 (inclusive) | 10.14.7 |
December 5, 2025 |
| CVE-2025-64381 | Medium | 0.2% | 10.14.7 and earlier | 10.14.8 |
November 13, 2025 |
| CVE-2025-9346 | Medium | 0.2% | 0 to 10.14.1 (inclusive) | 10.14.2 |
August 28, 2025 |
| CVE-2026-93655 | Medium | 0.4% | 0 to 11.8.3 (inclusive) | 11.8.4 |
September 22, 2026 |
| CVE-2026-92561 | Medium | 0.4% | 0 to 11.8.2 (inclusive) | 11.8.3 |
September 18, 2026 |
| CVE-2024-8274 | Medium | 0.5% | Before 10.5.1 | 10.5.1 |
August 30, 2024 |
| CVE-2025-4669 | Medium | 0.4% | 10.11.1 and earlier | 10.11.2 |
May 17, 2025 |
| CVE-2024-13323 | Medium | 0.4% | Before 10.9.3 | 10.9.3 |
January 14, 2025 |
| CVE-2024-6930 | Medium | 0.3% | Before 10.2.2 | 10.2.2 |
July 24, 2024 |
| CVE-2026-18496 | Medium | 0.2% | 0 to 11.4.3 (inclusive) | 11.5 |
October 10, 2026 |
| CVE-2026-105193 | Medium | 0.1% | Before 11.8 | 11.8 |
October 8, 2026 |
| CVE-2026-39601 | Medium | 0.2% | 11.8.4 and earlier | 11.9 |
October 2, 2026 |
| CVE-2026-74002 | Medium | 0.3% | 11.7 and earlier | 11.8 |
September 16, 2026 |
| CVE-2026-1431 | Medium | 0.3% | 0 to 10.14.13 (inclusive) | 10.14.14 |
January 31, 2026 |
| CVE-2025-14146 | Medium | 0.4% | 0 to 10.14.10 (inclusive) | 10.14.11 |
January 9, 2026 |
| CVE-2024-13821 | Medium | 0.4% | Before 10.10.1 | 10.10.1 |
February 12, 2025 |
| CVE-2026-32358 | Medium | 0.4% | 10.14.15 and earlier | 10.14.16 |
February 14, 2026 |
| CVE-2024-9306 | Medium | 0.3% | Before 10.6.1 | 10.6.1 |
October 4, 2024 |
| CVE-2026-2230 | Medium | 0.2% | 0 to 10.14.14 (inclusive) | 10.14.15 |
February 18, 2026 |
| CVE-2025-14982 | Medium | 0.4% | 0 to 10.14.11 (inclusive) | 10.14.12 |
January 16, 2026 |
| CVE-2022-33177 | Medium | 0.3% | 9.2.1 and earlier | 9.2.2 |
September 6, 2022 |
| WF-f0b25726-0b8e-4fce-a986-5f1e176da75a | Medium | — | Before 4.1.6 | 4.1.6 |
August 1, 2014 |
| CVE-2026-105195 | Low | 0.2% | 10.15 to 11.8.2 (inclusive) | 11.8.3 |
October 8, 2026 |