Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?booking-calendarAppointment Booking CalendarBooking Calendar Contact FormAdvanced Booking CalendarWP Simple Booking CalendarBooking Calendar and NotificationMulti-day Booking Calendar
Plugin · booking-calendar-contact-form
Booking Calendar Contact Form
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Apr 24, 2026Booking Calendar Contact Form: Insecure Direct Object ReferenceCVE-2026-6810 · affects up to 1.2.63 · reported by WordfenceMedium 5.3
The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 22, 2025Booking Calendar Contact Form: Missing AuthorizationCVE-2025-13318 · affects up to 1.2.60 · reported by WordfenceMedium 5.3
The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and bypass payment requirements via the 'dex_bccf_ipn' parameter.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 4, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48231 · affects up to 1.2.58 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.58.
Jan 24, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24723 · affects up to 1.2.55 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
Dec 9, 2024Booking Calendar Contact Form: Missing AuthorizationCVE-2023-25037 · affects up to 1.2.34 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.
Jul 18, 2023Unauth.CVE-2023-36384 · affects up to 1.2.40 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions.
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2016-10909 · fixed in 1.0.24 · reported by MITRECritical 9.8
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Aug 21, 2019The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-10908 · fixed in 1.0.24 · reported by MITREMedium 6.1
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.