These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.
A race condition vulnerability in the WPdevelop Booking Calendar plugin allows attackers to leverage race conditions, potentially disrupting service or leading to unauthorized actions. This issue affects Booking Calendar versions from n/a through 11.8.4. Defenders should assess exposure and prioritize patching to prevent potential exploitation. The vulnerability's impact is considered low, with a CVSS sco [truncated]
The Booking Calendar plugin for WordPress has a Privilege Escalation vulnerability in versions up to and including 11.8.2. Authenticated attackers with Editor-level access can escalate privileges to Administrator by manipulating core WordPress options, potentially leading to arbitrary core WordPress option manipulation and unauthorized Administrator account creation. This vulnerability exists due to insuf [truncated]
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicki [truncated]
CVE-2026-74002 is a medium-severity vulnerability in the Booking Calendar plugin, version 11.7 or earlier. It allows unauthenticated attackers to bypass access controls. The CVE record was published on 2026-09-17T14:17:23.200Z and has not been modified since then.
CVE-2026-59558 is a high-severity Unauthenticated Cross Site Scripting (XSS) vulnerability in Booking Calendar versions up to 11.4.2. The vulnerability has a CVSS score of 7.1 and a CVSS severity of HIGH. This vulnerability could allow attackers to inject malicious scripts into the Booking Calendar, potentially leading to unauthorized actions or data breaches. Users of Booking Calendar versions up to 11.4 [truncated]