VikAppointments Services Booking Calendar vulnerabilities

3 known vulnerabilities in VikAppointments Services Booking Calendar from E4jvikwp. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  VikAppointments Services Booking Calendar: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-87115Oct 3, 2026E4jvikwp

  The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticate

• 7.5 High severity

  VikAppointments Services Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-15918Aug 5, 2026E4jvikwp

  VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query with

• 7.1 High severity

  VikAppointments Services Booking Calendar: Improper Neutralization of Input During Web Page Generation

  CVE-2025-22719Jan 21, 2025E4jvikwp

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikappointments allows Stored XSS.This issue affects VikAppointments Services Booking Calendar: from n/a th