Known vulnerabilities in WP BASE Booking of Appointments, Services and Events

The most feature rich and flexible appointment and service booking platform that allows business owners accept hourly or daily reservations.

8Reported vulnerabilities

9.8Highest CVSS score

6.4.0Latest version

200+Active installs

What to do now

Update WP BASE Booking of Appointments, Services and Events to 6.4.0 or later. 8 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 18, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-12737	Medium 6.1	0.6%	Before 5.0.0	`5.0.0`	February 26, 2025
CVE-2026-61962	Critical 9.8	0.5%	6.3.0 and earlier	`6.3.1`	August 11, 2026
CVE-2026-59541	Critical 9.8	0.4%	6.3.1 and earlier	`6.3.2`	July 22, 2026
CVE-2026-39587	Critical 9.8	0.3%	5.9.0 and earlier	`6.0.0`	April 8, 2026
CVE-2025-22684	High 7.2	0.3%	5.0.0 and earlier	`5.1.0`	January 31, 2025
CVE-2024-12558	Medium 6.5	1.2%	0 to 4.9.2 (inclusive)	`5.0.0`	December 21, 2024
CVE-2026-73402	Medium 6.4	0.2%	6.3.2 and earlier	`6.4.0`	August 20, 2026
CVE-2024-12469	Medium 6.1	0.4%	0 to 4.9.1 (inclusive)	`4.9.2`	December 17, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.