Bookit — Booking & Appointment Calendar vulnerabilities

2 known vulnerabilities in Bookit — Booking & Appointment Calendar from StellarWP. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Bookit — Booking & Appointment Calendar: Missing Authorization

  CVE-2025-12633Nov 12, 2025StellarWP

  The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and includ

• 9.8 Critical severity

  Bookit — Booking & Appointment Calendar: Missing Authentication for Critical Functionality

  CVE-2023-2834Jun 30, 2023StellarWPEPSS 1.91%

  The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for una