# cve.now: Wpdevelop

The newest entries naming Wpdevelop as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-18496](https://cve.now/CVE-2026-18496.md): Booking Calendar \<= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC\_FLEXTIMELINE\_NAV' AJAX Action (CVSS 5.3)
- [CVE-2026-39601](https://cve.now/CVE-2026-39601.md): WordPress Booking Calendar plugin \<= 11.8.4 - Race Condition vulnerability (CVSS 3.7)
- [CVE-2026-93655](https://cve.now/CVE-2026-93655.md): Booking Calendar \<= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc\_auto\_fill' Parameter (CVSS 6.1)
- [CVE-2026-92561](https://cve.now/CVE-2026-92561.md): Booking Calendar \<= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter (CVSS 6.1)
- [CVE-2026-92619](https://cve.now/CVE-2026-92619.md): Booking Calendar \<= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data\_name' Parameter (CVSS 7.2)
- [CVE-2026-74002](https://cve.now/CVE-2026-74002.md): WordPress Booking Calendar plugin \<= 11.7 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-59558](https://cve.now/CVE-2026-59558.md): WordPress Booking Calendar plugin \<= 11.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-42751](https://cve.now/CVE-2026-42751.md): WordPress Booking Manager plugin \<= 2.1.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-32358](https://cve.now/CVE-2026-32358.md): WordPress Booking Calendar plugin \<= 10.14.15 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-2230](https://cve.now/CVE-2026-2230.md): Booking Calendar \<= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification (CVSS 4.3)
- [CVE-2026-1431](https://cve.now/CVE-2026-1431.md): Booking Calendar \<= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure (CVSS 5.3)
- [CVE-2025-14982](https://cve.now/CVE-2025-14982.md): Booking Calendar \<= 10.14.11 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-14146](https://cve.now/CVE-2025-14146.md): Booking Calendar \<= 10.14.10 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-14383](https://cve.now/CVE-2025-14383.md): Booking Calendar \<= 10.14.8 - Unauthenticated SQL Injection via dates\_to\_check (CVSS 7.5)
- [CVE-2025-12804](https://cve.now/CVE-2025-12804.md): Booking Calendar \<= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode (CVSS 6.4)
- [CVE-2025-64381](https://cve.now/CVE-2025-64381.md): WordPress Booking Calendar plugin \<= 10.14.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-64275](https://cve.now/CVE-2025-64275.md): WordPress Booking Manager plugin \<= 2.1.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-9346](https://cve.now/CVE-2025-9346.md): Booking Calendar \<= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-4669](https://cve.now/CVE-2025-4669.md): Booking Calendar \<= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode (CVSS 6.4)
- [CVE-2024-13821](https://cve.now/CVE-2024-13821.md): WP Booking Calendar \<= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation (CVSS 5.3)
- [CVE-2024-13323](https://cve.now/CVE-2024-13323.md): Booking Calendar \<= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode (CVSS 6.4)
- [CVE-2024-56292](https://cve.now/CVE-2024-56292.md): WordPress Email Reminders Plugin \<= 2.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-11945](https://cve.now/CVE-2024-11945.md): Email Reminders \<= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4)
- [CVE-2024-9306](https://cve.now/CVE-2024-9306.md): WP Booking Calendar \<= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-8274](https://cve.now/CVE-2024-8274.md): WP Booking Calendar \<= 10.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-6930](https://cve.now/CVE-2024-6930.md): WP Booking Calendar \<= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode (CVSS 6.4)
- [CVE-2024-1207](https://cve.now/CVE-2024-1207.md): Booking Calendar \<= 9.9 - Unauthenticated SQL Injection (CVSS 9.8)
- [CVE-2022-1463](https://cve.now/CVE-2022-1463.md): Booking Calendar \<= 9.1 - PHP Object Injection via Shortcode (CVSS 8.8)
- [CVE-2017-2151](https://cve.now/CVE-2017-2151.md): Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2017-2150](https://cve.now/CVE-2017-2150.md): Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpdevelop
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.