Appointment Booking Calendar vulnerabilities

3 known vulnerabilities in Appointment Booking Calendar from CodePeople. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Appointment Booking Calendar: Missing Authorization

  CVE-2025-46247Apr 22, 2025CodePeople

  Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

• 8.8 High severity

  Appointment Booking Calendar: Cross-Site Request Forgery

  CVE-2025-46241Apr 22, 2025CodePeople

  Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

• 8.8 High severity

  Appointment Booking Calendar: Cross-Site Request Forgery

  CVE-2024-0856Mar 20, 2024Appointment Booking Calendar

  The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.