Unknown Booking For Appointments And Events Calendar vulnerabilities

9 CVEs affecting Unknown Booking For Appointments And Events Calendar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77705, published 2026-09-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-77705, published 2026-09-12. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked…
CVE-2026-14215, published 2026-09-02. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an…
CVE-2026-14216, published 2026-08-26. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to…
CVE-2026-77689, published 2026-09-12. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway…
CVE-2026-77704, published 2026-08-29. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing…
CVE-2026-14214, published 2026-08-01. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role…
CVE-2026-14211, published 2026-08-10. Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed,…
CVE-2026-14213, published 2026-08-13. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any…
CVE-2026-14212, published 2026-08-26. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee…