VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 14 known issues Latest disclosed Nov 21, 2025

Appointment Booking Calendar Vulnerabilities

Review known vulnerability records for the WordPress plugin Appointment Booking Calendar (`appointment-booking-calendar`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-13317, CVE-2025-64261 and CVE-2025-46241, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
14
High or Critical
5
Patch Coverage
100%
Last Updated
Nov 22, 2025
Related Security Guides

Use these guides while reviewing Appointment Booking Calendar fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Appointment Booking Calendar remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
12
1. Match the Package
Confirm the installed WordPress plugin slug is appointment-booking-calendar before acting on any CVE from this cluster.
2. Sort by Severity
Start with 5 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
14 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2016-10916 Critical
SQL Injection remediation for Appointment Booking Calendar

Affected range: Versions before 1.1.24. Fixed version: 1.1.24.

CVE-2015-7319 Critical
SQL Injection remediation for Appointment Booking Calendar

Affected range: Versions up to 1.1.7. Fixed version: 1.1.8.

CVE-2020-9372 High
Remote Code Execution remediation for Appointment Booking Calendar

Affected range: Versions before 1.3.35. Fixed version: 1.3.35.

CVE-2025-46241 Medium
SQL Injection remediation for Appointment Booking Calendar

Affected range: Versions up to 1.3.92. Fixed version: 1.3.93.

Priority CVE Quick Links

Fast paths into Appointment Booking Calendar CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
12
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2016-10916
Appointment Booking Calendar <= 1.1.23 - SQL Injection
 SQL Injection Versions before 1.1.24 1.1.24 CVSS 9.8
CVE-2015-7319
Appointment Booking Calendar <= 1.1.7 - SQL Injection
 SQL Injection Versions up to 1.1.7 1.1.8 CVSS 9.8
CVE-2020-9372
Appointment Booking Calendar <= 1.3.34 - CSV Injection
 Remote Code Execution Versions before 1.3.35 1.3.35 CVSS 7.8
CVE-2025-46241
Appointment Booking Calendar <= 1.3.92 - Cross-Site Request Forgery to SQL Injection
 SQL Injection Versions up to 1.3.92 1.3.93 CVSS 6.5
CVE-2019-14791
Appointment Booking Calendar < 1.3.19 - Cross-Site Scripting
 Cross-Site Scripting Versions before 1.3.19 1.3.19 CVSS 6.1
CVE-2015-7320
Appointment Booking Calendar <= 1.1.7 - Multiple Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 1.1.7 1.1.8 CVSS 6.1
CVE-2024-0856
Appointment Booking Calendar <= 1.3.82 - Cross-Site Request Forgery
 Cross-Site Request Forgery Versions up to 1.3.82 1.3.83 CVSS 5.4
CVE-2025-13317
Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking...
 Vulnerability Versions up to 1.3.96 1.3.97 CVSS 5.3
CVE-2016-10916 Critical 1.1.24
CVE-2016-10916 Appointment Booking Calendar SQL Injection

Appointment Booking Calendar <= 1.1.23 - SQL Injection

CVE-2015-7319 Critical 1.1.8
CVE-2015-7319 Appointment Booking Calendar SQL Injection

Appointment Booking Calendar <= 1.1.7 - SQL Injection

CVE-2020-9372 High 1.3.35
CVE-2020-9372 Appointment Booking Calendar Remote Code Execution

Appointment Booking Calendar <= 1.3.34 - CSV Injection

CVE-2025-46241 Medium 1.3.93
CVE-2025-46241 Appointment Booking Calendar SQL Injection

Appointment Booking Calendar <= 1.3.92 - Cross-Site Request Forgery to SQL Injection

CVE-2019-14791 Medium 1.3.19
CVE-2019-14791 Appointment Booking Calendar Cross-Site Scripting

Appointment Booking Calendar < 1.3.19 - Cross-Site Scripting

CVE-2015-7320 Medium 1.1.8
CVE-2015-7320 Appointment Booking Calendar Cross-Site Scripting

Appointment Booking Calendar <= 1.1.7 - Multiple Reflected Cross-Site Scripting

CVE-2024-0856 Medium 1.3.83
CVE-2024-0856 Appointment Booking Calendar Cross-Site Request Forgery

Appointment Booking Calendar <= 1.3.82 - Cross-Site Request Forgery

CVE-2025-13317 Medium 1.3.97
CVE-2025-13317 Appointment Booking Calendar Vulnerability

Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Appointment Booking Calendar so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
14 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
3 critical and 2 high severity findings.
Recent CVEs
CVE-2025-13317, CVE-2025-64261 and CVE-2025-46241
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Appointment Booking Calendar

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-13317
CVE-2025-13317: Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts att...

Published
Nov 21, 2025
Patched Release
1.3.97
Affected Versions
Versions up to 1.3.96
Next Step
Update to 1.3.97 or newer if supported.
Review CVE-2025-13317 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-64261
CVE-2025-64261: Appointment Booking Calendar <= 1.3.95 - Missing Authorization

The Appointment Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.95. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

Published
Nov 15, 2025
Patched Release
1.3.96
Affected Versions
Versions up to 1.3.95
Next Step
Update to 1.3.96 or newer if supported.
Review CVE-2025-64261 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-46241
CVE-2025-46241: Appointment Booking Calendar <= 1.3.92 - Cross-Site Request Forgery to SQL Injection

The Appointment Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.92. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject SQL queri...

Published
Apr 22, 2025
Patched Release
1.3.93
Affected Versions
Versions up to 1.3.92
Next Step
Update to 1.3.93 or newer if supported.
Review CVE-2025-46241 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-46247
CVE-2025-46247: Appointment Booking Calendar <= 1.3.92 - Missing Authorization

The Appointment Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.92. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Published
Apr 22, 2025
Patched Release
1.3.93
Affected Versions
Versions up to 1.3.92
Next Step
Update to 1.3.93 or newer if supported.
Review CVE-2025-46247 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-0856
CVE-2024-0856: Appointment Booking Calendar <= 1.3.82 - Cross-Site Request Forgery

The Appointment Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.82. This is due to missing or incorrect nonce validation on the cpabc_appointments.php page. This makes it possible for unauthenticated atta...

Published
Feb 28, 2024
Patched Release
1.3.83
Affected Versions
Versions up to 1.3.82
Next Step
Update to 1.3.83 or newer if supported.
Review CVE-2024-0856 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2022-43482
CVE-2022-43482: Appointment Booking Calendar <= 1.3.69 - Missing Authorization

The Appointment Booking Calendar plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the cpabcal_feedback() function in versions up to, and including, 1.3.69. This makes it possible for authenticated attackers, with subscriber-level per...

Published
Oct 30, 2022
Patched Release
1.3.70
Affected Versions
Versions up to 1.3.69
Next Step
Update to 1.3.70 or newer if supported.
Review CVE-2022-43482 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2020-9371
CVE-2020-9371: Appointment Booking Calendar <= 1.3.34 - Stored Cross-Site Scripting

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.

Published
Mar 04, 2020
Patched Release
1.3.35
Affected Versions
Versions before 1.3.35
Next Step
Update to 1.3.35 or newer if supported.
Review CVE-2020-9371 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2020-9372
CVE-2020-9372: Appointment Booking Calendar <= 1.3.34 - CSV Injection

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The atta...

Published
Mar 04, 2020
Patched Release
1.3.35
Affected Versions
Versions before 1.3.35
Next Step
Update to 1.3.35 or newer if supported.
Review CVE-2020-9372 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2019-14791
CVE-2019-14791: Appointment Booking Calendar < 1.3.19 - Cross-Site Scripting

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.

Published
Jul 04, 2019
Patched Release
1.3.19
Affected Versions
Versions before 1.3.19
Next Step
Update to 1.3.19 or newer if supported.
Review CVE-2019-14791 fixed version details Open CVE Reference
Plugin Critical Patched: Yes
Appointment Booking Calendar <= 1.2.24 - SQL Injection

The Appointment Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via any of the 'specialDates=&workingDates&restrictedDates&timeWorkingDates0&timeWorkingDates1&timeWorkingDates2 &timeWorkingDates3&timeWorkingDates4&timeWorkingDates5& imeWorkingDates6'...

Published
Jan 27, 2016
Patched Release
1.2.25
Affected Versions
Versions up to 1.2.24
Next Step
Update to 1.2.25 or newer if supported.
Review Appointment Booking Calendar vulnerability details
Plugin High Patched: Yes
Appointment Booking Calendar <= 1.2.24 - Cross-Site Scripting

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as the 'name' and 'ict' parameters in versions up to, and including, 1.2.24. This is due to insufficient input sanitization and output escaping and makes...

Published
Jan 26, 2016
Patched Release
1.2.25
Affected Versions
Versions up to 1.2.24
Next Step
Update to 1.2.25 or newer if supported.
Review Appointment Booking Calendar vulnerability details
Plugin Critical Patched: Yes CVE-2016-10916
CVE-2016-10916: Appointment Booking Calendar <= 1.1.23 - SQL Injection

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.

Published
Jan 25, 2016
Patched Release
1.1.24
Affected Versions
Versions before 1.1.24
Next Step
Update to 1.1.24 or newer if supported.
Review CVE-2016-10916 fixed version details Open CVE Reference