Wpbookingcalendar Booking Calendar — known CVE vulnerabilities

Every CVE whose affected-product data names Wpbookingcalendar Booking Calendar, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2024-1207 — CVSS 9.8 (critical): The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter…
• CVE-2023-51520 — CVSS 6.5 (medium): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking…
• CVE-2024-6930 — CVSS 6.4 (medium): The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's…
• CVE-2023-4620 — CVSS 6.1 (medium): The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated…
• CVE-2022-33177 — CVSS 5.4 (medium): Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations…
• CVE-2024-13821 — CVSS 5.3 (medium): The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to…