Appointment Booking Calendar plugin for WordPress vulnerabilities
3 known CVE vulnerabilities in Appointment Booking Calendar plugin for WordPress, translated and rated.
- CVE-2015-7319High
The Appointment Booking Calendar plugin for WordPress before version 1.1.8 contains an SQL injection vulnerability in the cpabc_appointments_admin_int_calendar_list.inc.php file. This allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
- CVE-2026-1856Medium
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via custom booking field labels in all versions up to and including 1.4.4 due to insufficient input sanitization and output escaping.
- CVE-2026-12111Medium
The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function.