Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?WP Booking Systemwp-booking-system-premium
Plugin · wp-booking-system
WP Booking System
15 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 21, 2026WP Booking System: Does not validate and escape one of its parameters before reflecting it back in an admin pageCVE-2026-109147 · fixed in 2.1.0.3 · reported by WPScanHigh 7.1
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Oct 17, 2026WP Booking System – Booking Calendar: Authorization bypassCVE-2026-109369 · affects up to 2.1.0.3 · reported by WordfenceMedium 6.8
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026WP Booking System – Booking Calendar: Sensitive Information ExposureCVE-2026-109368 · affects up to 2.1.0.3 · reported by WordfenceMedium 6.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2026WP Booking System – Booking Calendar: Authorization bypassCVE-2026-108123 · affects up to 2.1.0.3 · reported by WordfenceHigh 7.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026WP Booking System – Booking Calendar: Generic SQL InjectionCVE-2026-111178 · affects up to 2.1.0.1 · reported by WordfenceMedium 4.9
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the targeted calendar to have more than 200 bookings, as the orderby value is only forwarded to the database layer when the AJAX handler takes the use_ajax branch; an Administrator can satisfy this condition by creating bookings directly.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026WP Booking System: Does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screenCVE-2026-107126 · fixed in 2.1.0.1 · reported by WPScanHigh 8.8
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.
Oct 10, 2026WP Booking System – Booking Calendar: Time-based SQL InjectionCVE-2026-107712 · affects up to 2.1.0.1 · reported by WordfenceMedium 6.5
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2026WP Booking System: Insertion of Sensitive Information Into Sent DataCVE-2025-68515 · affects up to 2.0.19.12 · reported by PatchstackMedium 5.8
Insertion of Sensitive Information Into Sent Data vulnerability in Roland Murg WP Booking System wp-booking-system allows Retrieve Embedded Sensitive Data.This issue affects WP Booking System: from n/a through <= 2.0.19.12.
Dec 9, 2024WP Booking System: Missing AuthorizationCVE-2023-49758 · affects up to 2.0.19.2 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Roland Murg WP Booking System wp-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Booking System: from n/a through <= 2.0.19.2.
Oct 29, 2024WP Booking System: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50425 · affects up to 2.0.19.10 · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects WP Booking System: from n/a through <= 2.0.19.10.
Sep 14, 2024WP Booking System – Booking Calendar: Reflected Cross-Site ScriptingCVE-2024-8797 · affects up to 2.0.19.8 · reported by WordfenceMedium 6.1
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2023Auth.CVE-2023-24402 · affects up to 2.0.18 · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Veribo, Roland Murg WP Booking System – Booking Calendar plugin <= 2.0.18 versions.
Jan 17, 2022WP Booking System: Was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin pageCVE-2021-25061 · fixed in 2.0.15 · reported by WPScanMedium 5.4
The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
May 20, 2019The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrativCVE-2019-12239 · fixed in 1.5.2 · reported by MITREHigh 7.2
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
May 22, 2017WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7: Cross-site scriptingCVE-2017-2168 · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.