Wpdevelop vulnerabilities
We track 5 vulnerabilities in Wpdevelop products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest Wpdevelop vulnerabilities
- 7.2 High severity
Booking Calendar: Improper Privilege Management
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safe
- 7.6 High severity
Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.
- 7.5 High severity
Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command
The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar
- 9.8 Critical severity
Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command
The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficie
- 8.8 High severity
Booking Calendar: Deserialization of Untrusted Data
The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulner