Skip to content
Unknown Calendar vulnerabilities
-
unknown modern event calendar pro, modern events calendar lite +1 more
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
CVE-2026-102499
7.7 High
-
unknown modern event calendar pro, modern events calendar lite +1 more
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
CVE-2026-96534
7.7 High
-
unknown modern events calendar lite
Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
CVE-2026-110070
6.5 Medium
-
unknown modern events calendar lite
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
CVE-2026-110069
4.3 Medium
-
unknown booking calendar
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
CVE-2026-105195
2.7 Low
-
unknown booking calendar
Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
CVE-2026-105193
4.8 Medium
-
stellarwp the events calendar
The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
CVE-2026-84740
6.5 Medium
-
stellarwp the events calendar
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
CVE-2026-84743
3.8 Low
-
stellarwp the events calendar
The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API
CVE-2026-84742
2.7 Low
-
stellarwp the events calendar
The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API
CVE-2026-84741
5.3 Medium
-
themefic hydra booking — appointment scheduling & booking calendar
Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
CVE-2026-92425
5.5 Medium
-
themefic hydra booking — appointment scheduling & booking calendar
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
CVE-2026-92421
4.7 Medium
-
themefic hydra booking — appointment scheduling & booking calendar
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
CVE-2026-92420
3.8 Low
-
stellarwp bookit — booking & appointment calendar
Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure
CVE-2026-89008
2.7 Low
-
stellarwp bookit — booking & appointment calendar
Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
CVE-2026-89007
2.7 Low
-
stellarwp bookit — booking & appointment calendar
Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check
CVE-2026-88995
5.3 Medium
-
unknown booking for appointments and events calendar
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
CVE-2026-77705
7.2 High
-
unknown booking for appointments and events calendar
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
CVE-2026-77689
5.3 Medium
-
stellarwp the events calendar
The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
CVE-2026-84745
2.7 Low
-
unknown booking for appointments and events calendar
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
CVE-2026-14215
6.5 Medium
-
unknown booking for appointments and events calendar
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
CVE-2026-77704
2.7 Low
-
unknown appointment booking calendar plugin and scheduling plugin
BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation
CVE-2026-76586
7.5 High
-
unknown booking for appointments and events calendar
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
CVE-2026-14216
6.5 Medium
-
unknown booking for appointments and events calendar
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
CVE-2026-14212
4.7 Medium
-
unknown booking calendar, appointment booking system
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
CVE-2026-14334
8.8 High
-
unknown booking for appointments and events calendar
Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR
CVE-2026-14213
3.7 Low
-
unknown booking for appointments and events calendar
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
CVE-2026-14211
3.8 Low
-
unknown simple google calendar outlook events widget
Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id
CVE-2026-16536
5.3 Medium
-
unknown booking for appointments and events calendar
Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
CVE-2026-14214
2.7 Low
-
humhub calendar
Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter
CVE-2026-14827
6.8 Medium
-
stellarwp the events calendar
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
CVE-2026-13390
5.3 Medium
-
roundupwp registrations for the events calendar – event registration plugin
Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter
CVE-2026-13119
6.5 Medium
-
unknown modern event calendar pro, modern events calendar lite +1 more
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
CVE-2026-11349
Public exploit
8.6 High
-
unknown appointment booking calendar plugin and scheduling plugin
BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection
CVE-2026-12378
8.1 High
-
unknown events-calendar, snumb130 events calendar +1 more
Event Calendar <= 1.0.4 - Admin+ Stored XSS
CVE-2024-8701
4.8 Medium
-
total-soft event calendar
Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion
CVE-2024-8700
7.5 High
-
stellarwp the events calendar
The Events Calendar < 6.6.4 - Admin+ Stored XSS
CVE-2024-8493
4.8 Medium
-
roundupwp registrations for the events calendar
Registrations for The Events Calendar < 2.13.4 - Admin+ Stored XSS
CVE-2024-10703
6.1 Medium
-
codepeople appointment booking calendar, unknown appointment booking calendar plugin and scheduling plugin +1 more
BookingPress < 1.1.23 - Unauthenticated Export File Download
CVE-2024-12274
7.5 High
-
stellarwp the events calendar
The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
CVE-2024-5333
5.3 Medium
-
unknown wp booking calendar
WP Booking Calendar < 10.6.5 - Admin+ Stored XSS
CVE-2024-10893
4.8 Medium
-
unknown wp booking calendar
WP Booking Calendar < 10.6.3 - Admin+ Stored XSS
CVE-2024-10027
4.8 Medium
-
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 more
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
CVE-2024-7877
4.8 Medium
-
croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments, nsquared appointment booking calendar +2 more
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
CVE-2024-7876
4.8 Medium
-
roundup wp registrations for the events calendar
WordPress Registrations for the Events Calendar plugin <= 2.12.1 - Broken Access Control vulnerability
CVE-2024-43143
6.4 Medium
-
roundupwp registrations for the events calendar
Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS
CVE-2024-7982
9.6 Critical
-
nsquared appointment booking calendar, croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsqua simply schedule appointments +2 more
Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE
CVE-2024-7129
7.2 High
-
roundup wp registrations for the events calendar
WordPress Registrations for the Events Calendar plugin <= 2.12.2 - SQL Injection vulnerability
CVE-2024-39638
8.5 High
-
itsourcecode event calendar, learning management system project in php with source code +1 more
itsourcecode Event Calendar process.php regDelete sql injection
CVE-2024-6009
5.3 Medium
-
stellarwp the events calendar, unknown events-calendar-pro, theeventscalendar events calendar pro +2 more
The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access
CVE-2024-1295
6.5 Medium
- Show olderLoading…