Plugin security history

Booking Calendar Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 30 vulnerability records associated with Booking Calendar, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

30Total records

1Critical

7High

22Medium

0Low

0Informational

30Patched records

0Currently marked unpatched

2014-08-01First disclosure

2026-07-27Latest disclosure

26 of 30CVE coverage

Use this history

Check and watch Booking Calendar.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Booking Calendar

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2016	3	3 records
2018	1	1 records
2021	1	1 records
2022	2	2 records
2023	3	3 records
2024	6	6 records
2025	7	7 records
2026	6	6 records

Severity Breakdown

Severity	Records	Share
Critical	1	3.3%
High	7	23.3%
Medium	22	73.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

15 records50%

First: 2016. Latest: 2026.

SQL Injection

6 records20%

First: 2016. Latest: 2026.

Missing Authorization

5 records16.7%

First: 2025. Latest: 2026.

CSRF

3 records10%

First: 2014. Latest: 2022.

Other

1 record3.3%

First: 2022. Latest: 2022.

Patch Status

Patched: 30
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

11.4.3
10.14.15
10.14.16
10.14.14
10.14.12
10.14.11
10.14.9
10.14.7
10.14.8
10.14.2
10.11.2
10.10.1
10.9.3
10.6.5
10.6.3
10.6.1
10.5.1
10.2.2
9.9.1
9.7.4
9.7.3.1
9.4.3.1
9.2.2
9.1.1
8.9.2
8.4.4
6.2.1
4.1.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-11.4.2`	Booking Calendar <= 11.4.2 - Unauthenticated Stored Cross-Site Scripting	July 27, 2026	11.4.3	High
`*-10.14.14`	Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification	February 17, 2026	10.14.15	Medium
`*-10.14.15`	Booking Calendar <= 10.14.15 - Authenticated (Editor+) SQL Injection	February 14, 2026	10.14.16	Medium
`*-10.14.13`	Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure	January 30, 2026	10.14.14	Medium
`*-10.14.11`	Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure	January 15, 2026	10.14.12	Medium
`*-10.14.10`	Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure	January 8, 2026	10.14.11	Medium
`*-10.14.8`	Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check	December 15, 2025	10.14.9	High
`*-10.14.6`	Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode	December 4, 2025	10.14.7	Medium
`*-10.14.7`	Booking Calendar <= 10.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	November 13, 2025	10.14.8	Medium
`*-10.14.1`	Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 27, 2025	10.14.2	Medium
`*-10.11.1`	Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode	May 16, 2025	10.11.2	Medium
`*-10.10`	WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation	February 11, 2025	10.10.1	Medium
`*-10.9.2`	Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode	January 13, 2025	10.9.3	Medium
`*-10.6.4`	WP Booking Calendar <= 10.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting	November 14, 2024	10.6.5	Medium
`*-10.6.2`	WP Booking Calendar <= 10.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting	October 17, 2024	10.6.3	Medium
`*-10.6`	WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting	October 3, 2024	10.6.1	Medium
`*-10.5`	WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting	August 29, 2024	10.5.1	Medium
`*-10.2.1`	WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode	July 23, 2024	10.2.2	Medium
`*-9.9`	Booking Calendar <= 9.9 - Unauthenticated SQL Injection	February 7, 2024	9.9.1	Critical
`[*, 9.7.4)`	Booking Calendar <= 9.7.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode	September 25, 2023	9.7.4	Medium
`*-9.7.3`	Booking Calendar <= 9.7.3 - Unauthenticated Stored Cross-Site Scripting	September 11, 2023	9.7.3.1	Medium
`*-9.4.2`	Booking Calendar <= 9.4.2 - Authenticated (Admin+) SQL Injection	January 20, 2023	9.4.3.1	Medium
`*-9.2.1`	Booking Calendar <= 9.2.1 - Cross-Site Request Forgery	September 6, 2022	9.2.2	Medium
`*-9.1`	Booking Calendar <= 9.1 - PHP Object Injection via Shortcode	April 18, 2022	9.1.1	High
`*-8.9.1`	Booking Calendar <= 8.9.1 - Reflected Cross-Site Scripting	December 6, 2021	8.9.2	Medium

Selected source records

Latest Records

HighCVE-2026-59558

Booking Calendar <= 11.4.2 - Unauthenticated Stored Cross-Site Scripting

Published: July 27, 2026

Affected versions: *-11.4.2
Patched versions: 11.4.3

Original Wordfence record

MediumCVE-2026-2230

Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification

Published: February 17, 2026

Affected versions: *-10.14.14
Patched versions: 10.14.15

Original Wordfence record

MediumCVE-2026-32358

Booking Calendar <= 10.14.15 - Authenticated (Editor+) SQL Injection

Published: February 14, 2026

Affected versions: *-10.14.15
Patched versions: 10.14.16

Original Wordfence record

MediumCVE-2026-1431

Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure

Published: January 30, 2026

Affected versions: *-10.14.13
Patched versions: 10.14.14

Original Wordfence record

MediumCVE-2025-14982

Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure

Published: January 15, 2026

Affected versions: *-10.14.11
Patched versions: 10.14.12

Original Wordfence record

MediumCVE-2025-14146

Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure

Published: January 8, 2026

Affected versions: *-10.14.10
Patched versions: 10.14.11

Original Wordfence record

HighCVE-2025-14383

Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check

Published: December 15, 2025

Affected versions: *-10.14.8
Patched versions: 10.14.9

Original Wordfence record

MediumCVE-2025-12804

Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode

Published: December 4, 2025

Affected versions: *-10.14.6
Patched versions: 10.14.7

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-1207

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

Published: February 7, 2024

Affected versions: *-9.9
Patched versions: 9.9.1

Original Wordfence record

High

Booking Calendar <= 6.2 - Cross-Site Request Forgery leading to Cross-Site Scripting

Published: August 1, 2016

Affected versions: [*, 6.2.1)
Patched versions: 6.2.1

Original Wordfence record

HighCVE-2018-20556

Booking Calendar <= 8.4.3 - SQL injection

Published: December 28, 2018

Affected versions: *-8.4.3
Patched versions: 8.4.4

Original Wordfence record

High

Booking Calendar <= 6.2 - Cross-Site Request Forgery to SQL Injection

Published: August 1, 2016

Affected versions: [*, 6.2.1)
Patched versions: 6.2.1

Original Wordfence record

HighCVE-2022-1463

Booking Calendar <= 9.1 - PHP Object Injection via Shortcode

Published: April 18, 2022

Affected versions: *-9.1
Patched versions: 9.1.1

Original Wordfence record

HighCVE-2025-14383

Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check

Published: December 15, 2025

Affected versions: *-10.14.8
Patched versions: 10.14.9

Original Wordfence record

HighCVE-2026-59558

Booking Calendar <= 11.4.2 - Unauthenticated Stored Cross-Site Scripting

Published: July 27, 2026

Affected versions: *-11.4.2
Patched versions: 11.4.3

Original Wordfence record

High

Booking Calendar <= 6.2 - Authenticated (Editor+) SQL Injection

Published: August 1, 2016

Affected versions: [*, 6.2.1)
Patched versions: 6.2.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory