Appointment booking calendar

This hub aggregates every CVE we track for Appointment booking calendar, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Appointment booking calendar.

• CVE-2026-12113Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure4.3Jul 1, 2026
• CVE-2026-12111Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter4.3Jun 18, 2026
• CVE-2025-13317Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter5.3Nov 22, 2025
• CVE-2025-64261WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability5.4Nov 13, 2025
• CVE-2025-46247WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability5.3Apr 22, 2025
• CVE-2025-46241WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability8.2Apr 22, 2025
• CVE-2024-13431Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting6.1Mar 7, 2025
• CVE-2024-12274BookingPress < 1.1.23 - Unauthenticated Export File Download7.5Jan 13, 2025
• CVE-2024-0856Booking Calendar < 1.3.83 - CSRF appointment scheduling8.8Mar 20, 2024
• CVE-2022-43482WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability4.3Nov 18, 2022
• CVE-2020-9372The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via...7.8Mar 4, 2020
• CVE-2020-9371Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaS...4.8Mar 4, 2020
• CVE-2016-10916The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.9.8Aug 22, 2019
• CVE-2019-14791The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.6.1Aug 9, 2019
• CVE-2015-7320Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attacker...4.3Sep 29, 2015