Where
-Infinity
0

Trending

Last week
Last month
Last year

CodePeople Appointment Booking CalendarWordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability

Risk 61
Severity
9.8
EPSS
0.06%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

Remedy

Update the WordPress Appointment Booking Calendar plugin to the latest available version (at least 1.3.93).
First published (updated )
CVE-2025-46247

CodePeople Appointment Booking CalendarWordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability

Risk 56
Severity
8.8
EPSS
0.02%
CSRF, SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

Remedy

Update the WordPress Appointment Booking Calendar plugin to the latest available version (at least 1.3.93).
First published (updated )
CVE-2025-46241

CodePeople Appointment Booking Calendar WordpressWordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability

Risk 79
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.

First published (updated )
CVE-2022-43482

CodePeople Appointment Booking Calendar WordpressThe Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields suc…

Risk 68
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabcappointments.php. The attacker could achieve remote code execution via CSV injection.

First published (updated )
CVE-2020-9372

CodePeople Appointment Booking Calendar WordpressXSS

Risk 29
Severity
4.8
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabcappointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.

First published (updated )
CVE-2020-9371

CodePeople Appointment Booking Calendar WordpressSQL Injection

Risk 86
Severity
9.8
SQL Injection
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.

First published (updated )
CVE-2016-10916

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203