Vulnerabilities / WP Booking System
WP Booking System vulnerabilities
Advisories WPSec published for WP Booking System – Booking Calendar. Other sources may list more. Its attack surface: WP Booking System on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-21 | WPSEC-2026-1378 | WP Booking System <= 2.1.0.4 - Authenticated (Subscriber+) Missing Authorization to Booking Modification via AJAX Actions | Medium 5.4 | 2.1.0.5 |
| 2026-10-17 | WPSEC-2026-1183 | WP Booking System <= 2.1.0.3 - Unauthenticated Missing Authorization to Booking Email Log Disclosure and Resend | Medium 6.5 | 2.1.0.4 |
| 2026-10-17 | WPSEC-2026-1182 | WP Booking System <= 2.1.0.3 - Authenticated (Subscriber+) Missing Authorization to Form Settings Update | Medium 4.3 | 2.1.0.4 |
| 2026-10-17 | WPSEC-2026-1181 | WP Booking System <= 2.1.0.3 - Authenticated (Subscriber+) Missing Authorization to Booking Data Exposure via Admin Calendar Refresh AJAX Action | Medium 4.3 | 2.1.0.4 |
| 2026-10-13 | WPSEC-2026-0836 | WP Booking System <= 2.1.0.2 - Reflected Cross-Site Scripting via 'booking_id' Parameter | Medium 6.1 | 2.1.0.3 |
| 2026-10-08 | WPSEC-2026-0653 | WP Booking System Free version <= 2.1 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header | High 7.2 | 2.1.0.1 |
License: CC BY 4.0