Wpbookingcalendar Wp Booking Calendar — known CVE vulnerabilities

Every CVE whose affected-product data names Wpbookingcalendar Wp Booking Calendar, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2024-13323 — CVSS 6.4 (medium): The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all…
• CVE-2025-4669 — CVSS 6.4 (medium): The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions…
• CVE-2024-8274 — CVSS 6.1 (medium): The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in…
• CVE-2024-10027 — CVSS 4.8 (medium): The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high…
• CVE-2024-10893 — CVSS 4.8 (medium): The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege…
• CVE-2024-9306 — CVSS 4.4 (medium): The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and…