Appointment Booking Calendar
16 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Appointment Booking Calendar, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Appointment Booking Calendar CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 2 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 2 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 1 |
| 2026-07 | 1 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 16 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High5
- Medium10
Latest CVEs
The 15 most recently published vulnerabilities affecting Appointment Booking Calendar.
- CVE-2026-12113Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure4.3
- CVE-2026-12111Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter4.3
- CVE-2025-13317Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter5.3
- CVE-2025-64261WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability5.4
- CVE-2025-46247WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability5.3
- CVE-2025-46241WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability8.2
- CVE-2024-13431Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting6.1
- CVE-2024-12274BookingPress < 1.1.23 - Unauthenticated Export File Download7.5
- CVE-2024-0856Booking Calendar < 1.3.83 - CSRF appointment scheduling8.8
- CVE-2022-43482WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability4.3
- CVE-2020-9372The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via...7.8
- CVE-2020-9371Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaS...4.8
- CVE-2016-10916The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.9.8
- CVE-2019-14791The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.6.1
- CVE-2015-7320Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attacker...4.3
Product grouping is registry-driven, with AI assist and human review. How it works