Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?ServiceWP BASE BookingWpBookinglyWPBot – AI ChatBot for Live Support, Lead Generation, AI ServicesFAT Services BookingCo-marquage service-public.frBooktics – Booking Calendar for Appointments and Service BusinessesElectrician - Electrical Service
Plugin · booktics
Booktics – Booking Calendar for Appointments and Service Businesses
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Booktics – Booking Calendar for Appointments and Service Businesses safe? The full page →
Oct 20, 2026Booktics: Missing AuthorizationCVE-2026-112829 · affects up to 1.0.30 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.
Oct 18, 2026Booktics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109895 · affects up to 1.0.29 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.
Oct 18, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109894 · affects up to 1.0.29 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
Oct 12, 2026Booktics: Missing AuthorizationCVE-2026-107418 · affects up to 1.0.28 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
Oct 12, 2026Booktics: Missing AuthorizationCVE-2026-108477 · affects up to 1.0.28 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
Oct 7, 2026Booktics: Missing AuthorizationCVE-2026-104390 · affects up to 1.0.27 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
Sep 11, 2026Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.CVE-2026-62135 · affects up to 1.0.24 · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
Sep 11, 2026Booktics – Booking Calendar for Appointments and Service Businesses: Unauthorized modification of dataCVE-2026-11446 · affects up to 1.0.23 · reported by WordfenceMedium 5.3
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-28002 · affects up to 1.0.22 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
Jul 2, 2026Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.CVE-2026-57621 · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.
Apr 8, 2026Booktics: Missing AuthorizationCVE-2026-39585 · affects up to 1.0.16 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.
Mar 10, 2026Booking Calendar for Appointments and Service Businesses – Booktics: Unauthorized modification of dataCVE-2026-1920 · affects up to 1.0.16 · reported by WordfenceMedium 5.3
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 10, 2026Booking Calendar for Appointments and Service Businesses – Booktics: Unauthorized access of dataCVE-2026-1919 · affects up to 1.0.16 · reported by WordfenceMedium 5.3
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.