Unknown Booking Calendar vulnerabilities

2 CVEs affecting Unknown Booking Calendar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-105195, published 2026-10-08.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-105195, published 2026-10-08. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor…
• CVE-2026-105193, published 2026-10-08. Medium severity, CVSS 4.8. EPSS: 0.1% chance of exploitation in the next 30 days. The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow…