https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-46247.htmlhttps://patchthecve.com/cve/CVE-2025-46247.htmlWed, 17 Jun 2026 09:26:05 +0000MEDIUM 5.3: Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.https://patchthecve.com/cve/CVE-2025-46241.htmlhttps://patchthecve.com/cve/CVE-2025-46241.htmlWed, 17 Jun 2026 09:26:05 +0000HIGH 8.2: Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.https://patchthecve.com/cve/CVE-2024-13431.htmlhttps://patchthecve.com/cve/CVE-2024-13431.htmlWed, 17 Jun 2026 07:02:00 +0000MEDIUM 6.1: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. https://patchthecve.com/cve/CVE-2024-12274.htmlhttps://patchthecve.com/cve/CVE-2024-12274.htmlWed, 17 Jun 2026 06:59:24 +0000HIGH 7.5: The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).https://patchthecve.com/cve/CVE-2024-0856.htmlhttps://patchthecve.com/cve/CVE-2024-0856.htmlWed, 17 Jun 2026 06:54:26 +0000HIGH 8.8: The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.