Description

WordPress Plugin Booking Calendar is prone to multiple vulnerabilities, including cross-site scripting and SQL injection vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, to compromise the application, access or modify data or to exploit vulnerabilities in the underlying database. WordPress Plugin Booking Calendar version 6.2 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 6.2.1 or latest

References

https://sumofpwn.nl/advisory/2016/sql_injection_vulnerability_in_booking_calendar_wordpress_plugin.html

https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_booking_calendar_wordpress_plugin.html

https://www.exploit-db.com/exploits/40189/

https://packetstormsecurity.com/files/138124/WordPress-Booking-Calendar-6.2.1-Cross-Site-Scripting.html

https://packetstormsecurity.com/files/138125/WordPress-Booking-Calendar-6.2-SQL-Injection.html

https://wordpress.org/plugins/booking/changelog/

Related Vulnerabilities

WordPress Plugin Stop User Enumeration Security Bypass (1.3.18)

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2023-0217)

Python Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2019-20907)

ownCloud Improper Input Validation Vulnerability (CVE-2013-1939)

SharePoint CVE-2025-21400 Vulnerability (CVE-2025-21400)

Severity

High

Classification

CWE-79 CWE-89 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update