Threat Database

Threat Entry Updated 2026-06-17

Booking Ultra Pro Appointments Booking Calendar Plugin - Broken Access Control (CVE-2024-6175)

The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like save_fields_settings, bup_delete_user_avatar, bup_crop_avatar_user_profile_image, and more in all versions up to, and including, 1.1.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete. multiple plugin options and data such as payments, pricing, booking information, business hours, calendars, profile information, and email templates.

PLUGIN Booking Ultra Pro Appointments Booking Calendar Plugin

CVE-2024-6175

MEDIUM CVSS 5.4 2024-07-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro Appointments Booking Calendar - Cross-Site Scripting (XSS) (CVE-2023-32511)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin plugin

PLUGIN Booking Ultra Pro Appointments Booking Calendar

CVE-2023-32511

HIGH CVSS 7.1 2023-08-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro Appointments Booking Calendar - Cross-Site Request Forgery (CSRF) (CVE-2022-46816)

Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro Appointments Booking Calendar Plugin plugin

PLUGIN Booking Ultra Pro Appointments Booking Calendar

CVE-2022-46816

MEDIUM CVSS 4.3 2023-05-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro Appointments Booking Calendar - Cross-Site Scripting (XSS) (CVE-2021-36855)

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin

PLUGIN Booking Ultra Pro Appointments Booking Calendar

CVE-2021-36855

MEDIUM CVSS 6.1 2022-09-30

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro Appointments Booking Calendar - Cross-Site Request Forgery (CSRF) (CVE-2021-36854)

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin

PLUGIN Booking Ultra Pro Appointments Booking Calendar

CVE-2021-36854

MEDIUM CVSS 5.4 2022-09-30

Risk Score

Open Full Technical Breakdown