Skip to main content

Booking Calendar CVE-2026-59558

| EUVDEUVD-2026-49225 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-07-27 Patchstack GHSA-45v6-jjpf-7xvm
WordPress XSS Booking Calendar Wordpress Plugin
7.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jul 27, 2026 - 14:52 vuln.today
CVE Published
Jul 27, 2026 - 13:59 cve.org
HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

AnalysisAI

Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.

More in Booking Calendar

View all
CVE-2024-1207 CRITICAL
9.8 Feb 08

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmy
CVE-2022-3982 CRITICAL POC
9.8 Dec 12

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which c
CVE-2022-1463 HIGH POC
8.8 May 10

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode

CVE-2018-5673 HIGH POC
8.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated high severity (CVSS 8.8), this vulnera
CVE-2023-4620 MEDIUM POC
6.1 Oct 16

The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowin
CVE-2018-5672 MEDIUM POC
4.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated medium severity (CVSS 4.8), this vulne
CVE-2018-5671 MEDIUM POC
4.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated medium severity (CVSS 4.8), this vulne
CVE-2018-5670 MEDIUM POC
4.8 Jan 13

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. Rated medium severity (CVSS 4.8), this vulne
CVE-2026-32358 HIGH
7.6 Mar 13

Booking Calendar versions 10.14.15 and earlier contain a blind SQL injection vulnerability in database query handling th
CVE-2018-10363 HIGH
7.5 Jun 13

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Rated
CVE-2022-47428 MEDIUM
6.7 Nov 06

A vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar.2.7. Rated medium severity (CV
CVE-2023-51520 MEDIUM
6.5 Feb 01

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugi

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-59558 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy