Veille CVE

Recherche « Unknown Booking Calendar »

25 CVE

Critique 0 Élevée 4 Moyenne 13 Faible 8 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Booking Calendar » ✕
  1. CVE-2026-105999 5.3 Moyenne

    Unknown Booking Package

    The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.

  2. CVE-2026-110069 4.3 Moyenne

    Unknown Modern Events Calendar Lite

    The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.

  3. CVE-2026-105195 2.7 Faible

    Unknown Booking Calendar

    The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.

  4. CVE-2026-105193 4.8 Moyenne

    Unknown Booking Calendar

    The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.

  5. CVE-2026-91024 6.8 Moyenne

    Unknown Booking Manager

    The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.

  6. CVE-2026-92425 5.5 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

  7. CVE-2026-92421 4.7 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

  8. CVE-2026-92420 3.8 Faible

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

  9. CVE-2026-89008 2.7 Faible

    Unknown Bookit — Booking & Appointment Calendar

    The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.

  10. CVE-2026-89007 2.7 Faible

    Unknown Bookit — Booking & Appointment Calendar

    The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.

  11. CVE-2026-88995 5.3 Moyenne

    Unknown Bookit — Booking & Appointment Calendar

    The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

  12. CVE-2026-77705 7.2 Élevée

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

  13. CVE-2026-77689 5.3 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

  14. CVE-2026-14215 6.5 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.

  15. CVE-2026-77704 2.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

  16. CVE-2026-76586 7.5 Élevée

    Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

    The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

  17. CVE-2026-14216 6.5 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

  18. CVE-2026-14212 4.7 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

  19. CVE-2026-14334 8.8 Élevée

    Unknown Booking calendar, Appointment Booking System

    The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.

  20. CVE-2026-14213 3.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

  21. CVE-2026-17023 4.8 Moyenne

    Unknown Salon Booking System

    The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

  22. CVE-2026-14211 3.8 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.

  23. CVE-2026-14214 2.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

  24. CVE-2026-12378 8.1 Élevée

    Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

    The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

  25. CVE-2026-9576 4.9 Moyenne

    Unknown Fluent Booking

    The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.