Booking Calendar Appointment Booking System
Monthly
A Stored Cross-Site Scripting (XSS) vulnerability exists in the wpdevart Booking Calendar and Appointment Booking System WordPress plugin through version 3.2.36, allowing attackers to inject and execute malicious JavaScript code that persists in the application database. An authenticated or unauthenticated attacker can exploit this vulnerability to steal session cookies, perform actions on behalf of legitimate users, or redirect visitors to malicious sites. No CVSS score, EPSS probability, or active exploitation in the wild (KEV status) are currently available, but the vulnerability affects a widely-used booking plugin and likely represents a significant risk given the prevalence of WordPress installations.
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface elevate practical risk for any business relying on appointment integrity.
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions through 3.2.36) permits unauthenticated remote attackers to write attacker-controlled payment status and transaction data directly into the plugin's payments database table, bypassing any payment gateway verification. This enables fraudulent marking of reservations as paid or completed, cancellation of legitimate customer payments, and dispatch of transactional booking confirmation emails to arbitrary parties. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Missing authorization in the wpdevart Booking Calendar, Appointment Booking System WordPress plugin (versions through 3.2.36) permits unauthenticated remote attackers to bypass access controls and perform restricted booking-related actions, resulting in unauthorized data modification. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is trivially reachable over the network with no authentication, though impact is limited to integrity (I:L) with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the wpdevart Booking Calendar and Appointment Booking System WordPress plugin through version 3.2.36, allowing attackers to inject and execute malicious JavaScript code that persists in the application database. An authenticated or unauthenticated attacker can exploit this vulnerability to steal session cookies, perform actions on behalf of legitimate users, or redirect visitors to malicious sites. No CVSS score, EPSS probability, or active exploitation in the wild (KEV status) are currently available, but the vulnerability affects a widely-used booking plugin and likely represents a significant risk given the prevalence of WordPress installations.
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface elevate practical risk for any business relying on appointment integrity.
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions through 3.2.36) permits unauthenticated remote attackers to write attacker-controlled payment status and transaction data directly into the plugin's payments database table, bypassing any payment gateway verification. This enables fraudulent marking of reservations as paid or completed, cancellation of legitimate customer payments, and dispatch of transactional booking confirmation emails to arbitrary parties. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Missing authorization in the wpdevart Booking Calendar, Appointment Booking System WordPress plugin (versions through 3.2.36) permits unauthenticated remote attackers to bypass access controls and perform restricted booking-related actions, resulting in unauthorized data modification. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is trivially reachable over the network with no authentication, though impact is limited to integrity (I:L) with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis.