{"items":[{"id":"CVE-2026-18496","published":"2026-10-10T05:30:55.792Z","updated":"2026-10-11T16:55:18.578Z","title":"Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-39601","published":"2026-10-02T14:49:13.832Z","updated":"2026-10-05T07:01:17.773Z","title":"WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability","severity":"LOW","score":3.7,"vendor":"WPdevelop","product":"Booking Calendar","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-93655","published":"2026-09-22T05:30:43.607Z","updated":"2026-09-22T12:44:10.086Z","title":"Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter","severity":"MEDIUM","score":6.1,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2026-92561","published":"2026-09-18T06:38:56.753Z","updated":"2026-09-18T14:31:43.589Z","title":"Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter","severity":"MEDIUM","score":6.1,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-92619","published":"2026-09-18T06:38:54.974Z","updated":"2026-09-18T18:32:21.018Z","title":"Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter","severity":"HIGH","score":7.2,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00656,"kevAdded":null},{"id":"CVE-2026-74002","published":"2026-09-17T13:24:53.587Z","updated":"2026-09-19T02:23:47.056Z","title":"WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-59558","published":"2026-07-27T13:59:14.892Z","updated":"2026-07-27T18:12:48.121Z","title":"WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-42751","published":"2026-05-27T09:49:05.581Z","updated":"2026-05-27T10:49:23.316Z","title":"WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevelop","product":"Booking Manager","kev":false,"epss":0.0013,"kevAdded":null},{"id":"CVE-2026-32358","published":"2026-03-13T11:42:03.699Z","updated":"2026-04-29T09:51:57.850Z","title":"WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability","severity":"HIGH","score":7.6,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-2230","published":"2026-02-18T16:28:14.595Z","updated":"2026-04-08T16:56:42.711Z","title":"Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification","severity":"MEDIUM","score":4.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-1431","published":"2026-01-31T04:35:14.563Z","updated":"2026-04-08T16:34:56.175Z","title":"Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-14982","published":"2026-01-16T04:44:33.474Z","updated":"2026-04-08T16:37:05.571Z","title":"Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure","severity":"MEDIUM","score":4.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2025-14146","published":"2026-01-09T07:22:09.760Z","updated":"2026-04-08T16:43:02.219Z","title":"Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2025-14383","published":"2025-12-15T14:25:11.795Z","updated":"2026-04-08T17:02:04.187Z","title":"Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check","severity":"HIGH","score":7.5,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2025-12804","published":"2025-12-05T01:55:22.221Z","updated":"2026-04-08T17:15:10.451Z","title":"Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode","severity":"MEDIUM","score":6.4,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2025-64381","published":"2025-11-13T09:24:35.014Z","updated":"2026-04-28T18:32:44.923Z","title":"WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-64275","published":"2025-11-13T09:24:31.484Z","updated":"2026-04-28T18:29:13.143Z","title":"WordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"wpdevelop","product":"Booking Manager","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2025-9346","published":"2025-08-28T03:42:44.982Z","updated":"2026-04-08T17:22:06.525Z","title":"Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"MEDIUM","score":6.4,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2025-4669","published":"2025-05-17T11:17:17.095Z","updated":"2026-04-08T17:33:13.268Z","title":"Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode","severity":"MEDIUM","score":6.4,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2024-13821","published":"2025-02-12T07:35:38.339Z","updated":"2026-06-03T14:27:35.250Z","title":"WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2024-13323","published":"2025-01-14T05:24:39.032Z","updated":"2026-04-08T16:46:22.579Z","title":"Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode","severity":"MEDIUM","score":6.4,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2024-56292","published":"2025-01-07T10:49:12.897Z","updated":"2026-04-28T16:10:56.984Z","title":"WordPress Email Reminders Plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability","severity":"MEDIUM","score":5.9,"vendor":"wpdevelop","product":"Email Reminders","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2024-11945","published":"2024-12-10T09:24:26.211Z","updated":"2026-04-08T17:12:15.454Z","title":"Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"MEDIUM","score":6.4,"vendor":"wpdevelop","product":"Email Reminders","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2024-9306","published":"2024-10-04T06:48:40.012Z","updated":"2026-04-08T16:36:26.672Z","title":"WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"MEDIUM","score":4.4,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2024-8274","published":"2024-08-30T09:29:48.794Z","updated":"2026-04-08T17:04:09.365Z","title":"WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting","severity":"MEDIUM","score":6.1,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2024-6930","published":"2024-07-24T07:31:48.088Z","updated":"2026-04-08T16:43:32.519Z","title":"WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode","severity":"MEDIUM","score":6.4,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2024-1207","published":"2024-02-08T08:32:07.622Z","updated":"2026-04-08T17:01:47.990Z","title":"Booking Calendar <= 9.9 - Unauthenticated SQL Injection","severity":"CRITICAL","score":9.8,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.03151,"kevAdded":null},{"id":"CVE-2022-1463","published":"2022-05-10T19:37:41.000Z","updated":"2025-02-13T20:42:52.167Z","title":"Booking Calendar <= 9.1 - PHP Object Injection via Shortcode","severity":"HIGH","score":8.8,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.01716,"kevAdded":null},{"id":"CVE-2017-2151","published":"2017-04-28T16:00:00.000Z","updated":"2024-08-05T13:48:03.509Z","title":"Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified…","severity":"MEDIUM","score":6.1,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.0085,"kevAdded":null},{"id":"CVE-2017-2150","published":"2017-04-28T16:00:00.000Z","updated":"2024-08-05T13:48:03.531Z","title":"Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted…","severity":"MEDIUM","score":5.3,"vendor":"wpdevelop","product":"Booking Calendar","kev":false,"epss":0.02397,"kevAdded":null}]}