Plugin security history

Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 18 vulnerability records associated with Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress, published between 2022 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

18Total records

2Critical

6High

10Medium

0Low

0Informational

18Patched records

0Currently marked unpatched

2022-02-28First disclosure

2025-04-01Latest disclosure

17 of 18CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	3	3 records
2023	4	4 records
2024	9	9 records
2025	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	2	11.1%
High	6	33.3%
Medium	10	55.6%

Vulnerability-Type Breakdown

SQL Injection

6 records33.3%

First: 2022. Latest: 2025.

Missing Authorization

4 records22.2%

First: 2022. Latest: 2024.

Arbitrary File Upload

2 records11.1%

First: 2023. Latest: 2024.

Other

2 records11.1%

First: 2023. Latest: 2024.

Information Disclosure

1 record5.6%

First: 2023. Latest: 2023.

Path Traversal

1 record5.6%

First: 2024. Latest: 2024.

Authentication Bypass

1 record5.6%

First: 2024. Latest: 2024.

Cross-Site Scripting

1 record5.6%

First: 2025. Latest: 2025.

Patch Status

Patched: 18
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.1.38
1.1.26
1.1.22
1.1.23
1.1.17
1.1.8
1.1.6
1.0.83
1.0.82
1.0.88
1.0.75
1.0.73
1.0.77
1.0.65
1.0.31
1.0.14
1.0.11

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.1.28`	BookingPress <= 1.1.28 - Authenticated (Administrator+) SQL Injection	April 1, 2025	1.1.38	Medium
`*-1.1.25`	BookingPress <= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 24, 2025	1.1.26	Medium
`*-1.1.21`	Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection	December 23, 2024	1.1.22	Medium
`*-1.1.22`	BookingPress <= 1.1.22 - Unauthenticated File Export Download	December 23, 2024	1.1.23	Medium
`*-1.1.16`	Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.16 - Authenticated (Subscriber+) SQL Injection	November 1, 2024	1.1.17	Medium
`1.1.6-1.1.7`	Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover	August 7, 2024	1.1.8	Critical
`*-1.1.5`	BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload	July 16, 2024	1.1.6	High
`*-1.1.5`	BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation	July 16, 2024	1.1.6	High
`*-1.0.82`	BookingPress <= 1.0.82 - Missing Authorization to Appointment Time Alteration	May 20, 2024	1.0.83	Medium
`*-1.0.81`	BookingPress <= 1.0.81 - Authenticated (Customer+) Insecure Direct Object Reference	April 5, 2024	1.0.82	Medium
`*-1.0.87`	BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload	April 3, 2024	1.0.88	High
`*-1.0.74`	BookingPress <= 1.0.74 - Booking Price Manipulation via bookingpress_confirm_booking	December 27, 2023	1.0.75	High
`*-1.0.72`	BookingPress <= 1.0.72 - Authenticated (Contributor+) SQL Injection	December 21, 2023	1.0.73	High
`*-1.0.76`	BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload	November 27, 2023	1.0.77	High
`*-1.0.64`	BookingPress <= 1.0.64 - Unauthenticated Sensitive Information Exposure	July 13, 2023	1.0.65	Medium
`*-1.0.30`	BookingPress <= 1.0.30 - Unauthenticated Insecure Direct Object Reference	December 7, 2022	1.0.31	Medium
`*-1.0.13`	BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.13 - SQL Injection	April 8, 2022	1.0.14	Medium
`[*, 1.0.11)`	BookingPress < 1.0.11 - SQL Injection	February 28, 2022	1.0.11	Critical

Selected source records

Latest Records

MediumCVE-2025-31910

BookingPress <= 1.1.28 - Authenticated (Administrator+) SQL Injection

Published: April 1, 2025

Affected versions: *-1.1.28
Patched versions: 1.1.38

Original Wordfence record

MediumCVE-2025-24732

BookingPress <= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions: *-1.1.25
Patched versions: 1.1.26

Original Wordfence record

MediumCVE-2024-12274

BookingPress <= 1.1.22 - Unauthenticated File Export Download

Published: December 23, 2024

Affected versions: *-1.1.22
Patched versions: 1.1.23

Original Wordfence record

MediumCVE-2024-11726

Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection

Published: December 23, 2024

Affected versions: *-1.1.21
Patched versions: 1.1.22

Original Wordfence record

MediumCVE-2024-10540

Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.16 - Authenticated (Subscriber+) SQL Injection

Published: November 1, 2024

Affected versions: *-1.1.16
Patched versions: 1.1.17

Original Wordfence record

CriticalCVE-2024-7350

Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover

Published: August 7, 2024

Affected versions: 1.1.6-1.1.7
Patched versions: 1.1.8

Original Wordfence record

HighCVE-2024-6660

BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload

Published: July 16, 2024

Affected versions: *-1.1.5
Patched versions: 1.1.6

Original Wordfence record

HighCVE-2024-6467

BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation

Published: July 16, 2024

Affected versions: *-1.1.5
Patched versions: 1.1.6

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-7350

Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover

Published: August 7, 2024

Affected versions: 1.1.6-1.1.7
Patched versions: 1.1.8

Original Wordfence record

CriticalCVE-2022-0739

BookingPress < 1.0.11 - SQL Injection

Published: February 28, 2022

Affected versions: [*, 1.0.11)
Patched versions: 1.0.11

Original Wordfence record

HighCVE-2024-6660

BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload

Published: July 16, 2024

Affected versions: *-1.1.5
Patched versions: 1.1.6

Original Wordfence record

HighCVE-2024-6467

BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation

Published: July 16, 2024

Affected versions: *-1.1.5
Patched versions: 1.1.6

Original Wordfence record

HighCVE-2023-50841

BookingPress <= 1.0.72 - Authenticated (Contributor+) SQL Injection

Published: December 21, 2023

Affected versions: *-1.0.72
Patched versions: 1.0.73

Original Wordfence record

HighCVE-2023-51405

BookingPress <= 1.0.74 - Booking Price Manipulation via bookingpress_confirm_booking

Published: December 27, 2023

Affected versions: *-1.0.74
Patched versions: 1.0.75

Original Wordfence record

HighCVE-2024-3022

BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload

Published: April 3, 2024

Affected versions: *-1.0.87
Patched versions: 1.0.88

Original Wordfence record

HighCVE-2023-6219

BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload

Published: November 27, 2023

Affected versions: *-1.0.76
Patched versions: 1.0.77

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory