Veille CVE

Recherche « Unknown Calendar »

38 CVE

Critique 0 Élevée 7 Moyenne 19 Faible 12 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Calendar » ✕
  1. CVE-2026-105999 5.3 Moyenne

    Unknown Booking Package

    The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.

  2. CVE-2026-102499 7.7 Élevée

    Unknown Modern Events Calendar Lite · Unknown Modern Event Calendar Pro

    The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.

  3. CVE-2026-96534 7.7 Élevée

    Unknown Modern Events Calendar Lite · Unknown Modern Event Calendar Pro

    The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

  4. CVE-2026-110070 6.5 Moyenne

    Unknown Modern Events Calendar Lite

    The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

  5. CVE-2026-110069 4.3 Moyenne

    Unknown Modern Events Calendar Lite

    The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.

  6. CVE-2026-110191 2.7 Faible

    Unknown Product Delivery Date for WooCommerce

    The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.

  7. CVE-2026-105195 2.7 Faible

    Unknown Booking Calendar

    The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.

  8. CVE-2026-105193 4.8 Moyenne

    Unknown Booking Calendar

    The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.

  9. CVE-2026-84740 6.5 Moyenne

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

  10. CVE-2026-91024 6.8 Moyenne

    Unknown Booking Manager

    The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.

  11. CVE-2026-84743 3.8 Faible

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

  12. CVE-2026-84742 2.7 Faible

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

  13. CVE-2026-84741 5.3 Moyenne

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

  14. CVE-2026-92425 5.5 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

  15. CVE-2026-92421 4.7 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

  16. CVE-2026-92420 3.8 Faible

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

  17. CVE-2026-89008 2.7 Faible

    Unknown Bookit — Booking & Appointment Calendar

    The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.

  18. CVE-2026-89007 2.7 Faible

    Unknown Bookit — Booking & Appointment Calendar

    The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.

  19. CVE-2026-88995 5.3 Moyenne

    Unknown Bookit — Booking & Appointment Calendar

    The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

  20. CVE-2026-77705 7.2 Élevée

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

  21. CVE-2026-77689 5.3 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

  22. CVE-2026-84745 2.7 Faible

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

  23. CVE-2026-14215 6.5 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.

  24. CVE-2026-77704 2.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

  25. CVE-2026-76586 7.5 Élevée

    Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

    The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

  26. CVE-2026-14216 6.5 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

  27. CVE-2026-14212 4.7 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

  28. CVE-2026-14334 8.8 Élevée

    Unknown Booking calendar, Appointment Booking System

    The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.

  29. CVE-2026-14213 3.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

  30. CVE-2026-17023 4.8 Moyenne

    Unknown Salon Booking System

    The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

  31. CVE-2026-14211 3.8 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.

  32. CVE-2026-16536 5.3 Moyenne

    Unknown Simple Google Calendar Outlook Events Widget

    The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

  33. CVE-2026-14214 2.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

  34. CVE-2026-14827 6.8 Moyenne

    Unknown Calendar

    The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.

  35. CVE-2026-13390 5.3 Moyenne

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.

  36. CVE-2026-11349 8.6 Élevée

    Unknown Modern Event Calendar Pro · Unknown Modern Events Calendar Lite

    The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.

  37. CVE-2026-12378 8.1 Élevée

    Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

    The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

  38. CVE-2026-9576 4.9 Moyenne

    Unknown Fluent Booking

    The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.