Is Appointment Booking Calendar safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (1.4.07). As of 2026-11-04. 16 issues are on record for older versions; version 1.4.06 or newer fixes all of them that state a fix. Keep Appointment Booking Calendar on the latest version (1.4.07) and remove it if you do not use it.

Which versions of Appointment Booking Calendar are vulnerable?

Known issues on record (newest first): Stored cross-site scripting (XSS) (1.4.05 and older, fixed in 1.4.06); Information disclosure (1.4.02 and older, fixed in 1.4.03); Information disclosure (1.4.01 and older, fixed in 1.4.02); Missing authorization check (1.3.96 and older, fixed in 1.3.97); Missing authorization check (1.3.95 and older, fixed in 1.3.96); Missing authorization check (1.3.92 and older, fixed in 1.3.93). The full list with sources is on this page.

What is the latest version of Appointment Booking Calendar?

1.4.07, according to wordpress.org (last updated 2026-10-26). It has 1,000+ active installs.

What should I do if my Appointment Booking Calendar is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update appointment-booking-calendar). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · appointment-booking-calendar · data as of 2026-11-04

Is Appointment Booking Calendar safe? Known vulnerabilities and latest version

Latest version: 1.4.07
Last updated: 2026-10-26
Active installs: 1,000+
Known issues on record: 16
Unpatched in latest: 0
Tested up to WP: 7.0.8

Appointment Booking Calendar is an appointment calendar for accepting online bookings from a set of available time-slots in a calendar. — by codepeople

What to do

Update to the latest version (1.4.07). Anything older than 1.4.06 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get appointment-booking-calendar --field=version shows what you run; wp plugin update appointment-booking-calendar updates it.

Check your version

Known vulnerabilities

16 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. 1 record(s) do not state which versions are affected.

medium 6.4 CVE-2026-111727 · published 2026-10-28

Stored cross-site scripting (XSS) in Appointment Booking Calendar (1.4.05 and older)

Affected: 1.4.05 and older
Fixed in: 1.4.06 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a per-user grant that any administrator can extend to users as low as Subscriber level through the plugin's calendar list screen. Exploitation by attackers with subscriber-level access and above requires that an administrator has assigned the attacker's account as owner (`conwer`) of a calendar via the plugin's calendar list screen; the plugin's UI lists all registered users regardless of role, so a Subscriber can be assigned. On a default installation, where that is not configured, the vulnerability requires attackers with editor-level access and above.

NVD CVE-2026-111727 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2026-12113 · published 2026-07-01

Information disclosure in Appointment Booking Calendar (1.4.02 and older)

Affected: 1.4.02 and older
Fixed in: 1.4.03 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, with contributor-level access and above, to extract customer names, email addresses, phone numbers, appointment comments, and other booking personally identifiable information.

NVD CVE-2026-12113 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2026-12111 · published 2026-06-18

Information disclosure in Appointment Booking Calendar (1.4.01 and older)

Affected: 1.4.01 and older
Fixed in: 1.4.02 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient authorization and missing per-calendar ownership checks in the cpabc_appointments_calendar_load2() function, which is reachable via the cpabc_calendar_load2=1 query parameter in wp-admin and only checks is_admin() && current_user_can('edit_posts'), a capability available to Contributor-level users and above. This makes it possible for authenticated attackers with Contributor-level access and above to supply an arbitrary calendar ID via the id parameter and extract customer booking information, including email addresses, names, phone numbers, booking times, and comments, from any calendar managed by the plugin.

NVD CVE-2026-12111 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2025-13317 · published 2025-11-22

Missing authorization check in Appointment Booking Calendar (1.3.96 and older)

Affected: 1.3.96 and older
Fixed in: 1.3.97 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.

NVD CVE-2025-13317 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2025-64261 · published 2025-11-13

Missing authorization check in Appointment Booking Calendar (1.3.95 and older)

Affected: 1.3.95 and older
Fixed in: 1.3.96
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.95.

NVD CVE-2025-64261 Patchstack advisory

critical 9.8 CVE-2025-46247 · published 2025-04-22

Missing authorization check in Appointment Booking Calendar (1.3.92 and older)

Affected: 1.3.92 and older
Fixed in: 1.3.93
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

NVD CVE-2025-46247 Patchstack advisory

high 8.8 CVE-2025-46241 · published 2025-04-22

Cross-site request forgery (CSRF) in Appointment Booking Calendar (1.3.92 and older)

Affected: 1.3.92 and older
Fixed in: 1.3.93
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

NVD CVE-2025-46241 Patchstack advisory

high 7.2 CVE-2024-7129 · published 2024-09-13

Remote code execution in Appointment Booking Calendar (older than 1.6.7.43)

Affected: older than 1.6.7.43
Fixed in: unknown
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by NVD

Note: the source's version range goes past the newest Appointment Booking Calendar release on wordpress.org (1.4.07), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins

NVD CVE-2024-7129 WPScan advisory

high 8.8 CVE-2024-0856 · published 2024-03-20

Cross-site request forgery (CSRF) in Appointment Booking Calendar (older than 1.3.83)

Affected: older than 1.3.83
Fixed in: 1.3.83
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.

NVD CVE-2024-0856 WPScan advisory

high 8.8 CVE-2022-43482 · published 2022-11-18

Missing authorization check in Appointment Booking Calendar (1.3.69 and older)

Affected: 1.3.69 and older
Fixed in: 1.3.70 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.

NVD CVE-2022-43482 Patchstack advisory

medium 4.8 CVE-2020-9371 · published 2020-03-04

Stored cross-site scripting (XSS) in Appointment Booking Calendar (older than 1.3.35)

Affected: older than 1.3.35
Fixed in: 1.3.35
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.

NVD CVE-2020-9371 wordpress.org packetstormsecurity.com drive.google.com wpvulndb.com hotdreamweaver.com

high 7.8 CVE-2020-9372 · published 2020-03-04

Remote code execution in Appointment Booking Calendar (older than 1.3.35)

Affected: older than 1.3.35
Fixed in: 1.3.35
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.

NVD CVE-2020-9372 wordpress.org packetstormsecurity.com drive.google.com hotdreamweaver.com

critical 9.8 CVE-2016-10916 · published 2019-08-22

SQL injection in Appointment Booking Calendar (older than 1.1.24)

Affected: older than 1.1.24
Fixed in: 1.1.24
Access needed (per CVSS): No login needed
Range from: NVD analysis · score by NVD

Details from the advisory

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.

NVD CVE-2016-10916 wordpress.org

medium 6.1 CVE-2019-14791 · published 2019-08-09

Cross-site scripting (XSS) in Appointment Booking Calendar (1.3.18 only)

Affected: 1.3.18 only
Fixed in: 1.3.51 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.

NVD CVE-2019-14791 wordpress.org wpvulndb.com pluginvulnerabilities.com

medium 4.3 CVE-2015-7320 · published 2015-09-29

Cross-site scripting (XSS) in Appointment Booking Calendar (1.1.7 and older)

Affected: 1.1.7 and older
Fixed in: 1.3.51 *
Range from: NVD analysis · score by NVD

Details from the advisory

Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

NVD CVE-2015-7320 wordpress.org packetstormsecurity.com securityfocus.com securityfocus.com wpvulndb.com

high 7.5 CVE-2015-7319 · published 2015-09-29

SQL injection in Appointment Booking Calendar (1.1.7 and older)

Affected: 1.1.7 and older
Fixed in: 1.3.51 *
Range from: NVD analysis · score by NVD

Details from the advisory

SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.

NVD CVE-2015-7319 wordpress.org packetstormsecurity.com securityfocus.com wpvulndb.com

Recent activity

2026-10-26 — latest release on wordpress.org (1.4.07).
2026-10-28 — Stored cross-site scripting (XSS) disclosed (CVE-2026-111727), fixed in 1.4.06.
2026-07-01 — Information disclosure disclosed (CVE-2026-12113), fixed in 1.4.03.
2026-06-18 — Information disclosure disclosed (CVE-2026-12111), fixed in 1.4.02.

Free. We check the CVE feeds every day and email you only when a new issue for Appointment Booking Calendar (appointment-booking-calendar) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Cross-site scripting (XSS) (4) · Missing authorization (4) · Sensitive data exposure (2) · Cross-site request forgery (CSRF) (2) · Remote code execution (2) · SQL injection (2)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/appointment-booking-calendar (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/appointment-booking-calendar"><img src="https://laskyr.com/plugins/appointment-booking-calendar/badge.svg" alt="Appointment Booking Calendar vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is Appointment Booking Calendar safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (1.4.07)

What to do

Check your version

Known vulnerabilities

Stored cross-site scripting (XSS) in Appointment Booking Calendar (1.4.05 and older)

Information disclosure in Appointment Booking Calendar (1.4.02 and older)

Information disclosure in Appointment Booking Calendar (1.4.01 and older)

Missing authorization check in Appointment Booking Calendar (1.3.96 and older)

Missing authorization check in Appointment Booking Calendar (1.3.95 and older)

Missing authorization check in Appointment Booking Calendar (1.3.92 and older)

Cross-site request forgery (CSRF) in Appointment Booking Calendar (1.3.92 and older)

Remote code execution in Appointment Booking Calendar (older than 1.6.7.43)

Cross-site request forgery (CSRF) in Appointment Booking Calendar (older than 1.3.83)

Missing authorization check in Appointment Booking Calendar (1.3.69 and older)

Stored cross-site scripting (XSS) in Appointment Booking Calendar (older than 1.3.35)

Remote code execution in Appointment Booking Calendar (older than 1.3.35)

SQL injection in Appointment Booking Calendar (older than 1.1.24)

Cross-site scripting (XSS) in Appointment Booking Calendar (1.3.18 only)

Cross-site scripting (XSS) in Appointment Booking Calendar (1.1.7 and older)

SQL injection in Appointment Booking Calendar (1.1.7 and older)

Recent activity

Get an email when Appointment Booking Calendar has a new vulnerability

Browse vulnerabilities

Where this data comes from