Search
Search Results (4 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-39601 | 2 Wordpress-extensions, Wpdevelop | 2 Booking Calendar, Booking Calendar | 2026-10-22 | 3.7 Low |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4. | ||||
| CVE-2026-18496 | 2 Wordpress-extensions, Wpdevelop | 2 Booking Calendar, Booking Calendar | 2026-10-20 | 5.3 Medium |
| The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings. | ||||
| CVE-2026-105193 | 1 Wordpress-extensions | 1 Booking Calendar | 2026-10-09 | 4.8 Medium |
| The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place. | ||||
| CVE-2026-105195 | 1 Wordpress-extensions | 1 Booking Calendar | 2026-10-09 | 2.7 Low |
| The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration. | ||||
Page 1 of 1.