Does Booking Calendar have any unpatched vulnerabilities?

No. All known vulnerabilities in Booking Calendar have been patched as of the latest data update. Always keep the plugin updated to the latest version.

Is Booking Calendar compatible with WordPress 6.9.4?

According to WordPress.org data, Booking Calendar 10.14.16 has been tested up to WordPress 6.9.4. Check the plugin's changelog for the latest compatibility information.

Is Booking Calendar compatible with PHP 5.6+?

Booking Calendar requires PHP 5.6 or higher. Most modern WordPress hosts run PHP 8.1 or 8.2. If you are on an older PHP version, consider upgrading before installing this plugin.

How often is Booking Calendar updated?

Booking Calendar was last updated on Feb 10, 2026. Frequent updates are generally a positive security signal.

What is Booking Calendar's security score?

Booking Calendar has a WP-Safety security score of 82/100. This score is computed from CVE history, patch response time, developer trust signals, and plugin maintenance activity.

Booking Calendar Security & Risk Analysis

wordpress.org/plugins/booking

Original "Booking Calendar" plugin. Easily manage full-day bookings, time-slot appointments, or events in our all-in-one, outstanding booking system.

50K active installs v10.14.16 PHP 5.6+ WP 5.3+ Updated Feb 10, 2026

appointmentsbookingbooking-calendarbookingsevents

B · Generally Safe

CVEs total28

Unpatched0

Last CVEFeb 17, 2026

Plugin page Download

Safety Verdict

Is Booking Calendar Safe to Use in 2026?

Mostly Safe

Score 82/100

Booking Calendar is generally safe to use. 28 past CVEs were resolved. Keep it updated.

28 known CVEsLast CVE: Feb 17, 2026Updated 1mo ago

Risk Assessment

The "booking" plugin version 10.14.16 exhibits a mixed security posture. While the static analysis shows a significant number of entry points (9 total), it's positive that all are protected by authentication or capability checks. The extensive use of prepared statements for SQL queries (91%) and proper output escaping (91%) are strong indicators of good development practices and a commitment to mitigating common web vulnerabilities. The presence of 34 nonce checks further bolsters its defensive capabilities against certain types of attacks.

However, several concerns emerge from the analysis. The presence of three "unserialize" functions indicates a potential risk of Deserialization of Untrusted Data vulnerabilities if user-controlled data is passed to these functions without proper validation. Taint analysis reveals one high-severity flow with unsanitized paths, which requires immediate attention as it could lead to data leakage or other security breaches. The vulnerability history is a significant red flag, with a total of 28 known CVEs, including one critical and six high-severity vulnerabilities in the past. Although there are currently no unpatched CVEs, the sheer volume and historical severity suggest a pattern of introducing security flaws. The common vulnerability types listed, such as Authorization Bypass, Missing/Improper Authorization, XSS, SQL Injection, CSRF, and Deserialization, reinforce the need for rigorous auditing and secure coding practices.

In conclusion, while "booking" v10.14.16 demonstrates some strong security implementations like robust authentication on entry points and good SQL/output sanitization, the persistent history of critical and high-severity vulnerabilities, coupled with the presence of potentially dangerous functions like `unserialize` and a high-severity taint flow, necessitates caution. The plugin's past security issues suggest a need for ongoing vigilance and thorough review of any updates.

Key Concerns

Dangerous function: unserialize found
High severity taint flow with unsanitized paths
History of 1 critical CVE
History of 6 high severity CVEs
History of 21 medium severity CVEs
Common vulnerability types suggest recurring issues

Vulnerabilities

Booking Calendar Security Vulnerabilities

CVEs by Year

1 CVE in 2014

2014

3 CVEs in 2016

2016

1 CVE in 2018

2018

1 CVE in 2021

2021

2 CVEs in 2022

2022

3 CVEs in 2023

2023

6 CVEs in 2024

2024

7 CVEs in 2025

2025

4 CVEs in 2026

2026

Patched Has unpatched

Severity Breakdown

Critical

High

Medium

28 total CVEs

CVE-2026-2230medium · 4.3Authorization Bypass Through User-Controlled Key

Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification

Feb 17, 2026 Patched in 10.14.15 (2d)

CVE-2026-1431medium · 5.3Missing Authorization

Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure

Jan 30, 2026 Patched in 10.14.14 (1d)

CVE-2025-14982medium · 4.3Missing Authorization

Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure

Jan 15, 2026 Patched in 10.14.12 (1d)

CVE-2025-14146medium · 5.3Missing Authorization

Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure

Jan 8, 2026 Patched in 10.14.11 (1d)

CVE-2025-14383high · 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check

Dec 15, 2025 Patched in 10.14.9 (1d)

CVE-2025-12804medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode

Dec 4, 2025 Patched in 10.14.7 (1d)

CVE-2025-64381medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 10.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Nov 13, 2025 Patched in 10.14.8 (5d)

CVE-2025-9346medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Aug 27, 2025 Patched in 10.14.2 (1d)

CVE-2025-4669medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode

May 16, 2025 Patched in 10.11.2 (1d)

CVE-2024-13821medium · 5.3Improper Authorization

WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation

Feb 11, 2025 Patched in 10.10.1 (1d)

CVE-2024-13323medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode

Jan 13, 2025 Patched in 10.9.3 (1d)

CVE-2024-10893medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

WP Booking Calendar <= 10.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Nov 14, 2024 Patched in 10.6.5 (29d)

CVE-2024-10027medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

WP Booking Calendar <= 10.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Oct 17, 2024 Patched in 10.6.3 (30d)

CVE-2024-9306medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting

Oct 3, 2024 Patched in 10.6.1 (1d)

CVE-2024-8274medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting

Aug 29, 2024 Patched in 10.5.1 (1d)

CVE-2024-6930medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode

Jul 23, 2024 Patched in 10.2.2 (1d)

CVE-2024-1207critical · 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

Feb 7, 2024 Patched in 9.9.1 (1d)

CVE-2023-51520medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 9.7.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

Sep 25, 2023 Patched in 9.7.4 (120d)

CVE-2023-4620medium · 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 9.7.3 - Unauthenticated Stored Cross-Site Scripting

Sep 11, 2023 Patched in 9.7.3.1 (134d)

CVE-2023-23991medium · 6.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Booking Calendar <= 9.4.2 - Authenticated (Admin+) SQL Injection

Jan 20, 2023 Patched in 9.4.3.1 (368d)

CVE-2022-33177medium · 5.4Cross-Site Request Forgery (CSRF)

Booking Calendar <= 9.2.1 - Cross-Site Request Forgery

Sep 6, 2022 Patched in 9.2.2 (503d)

CVE-2022-1463high · 8.5Deserialization of Untrusted Data

Booking Calendar <= 9.1 - PHP Object Injection via Shortcode

Apr 18, 2022 Patched in 9.1.1 (645d)

CVE-2021-25040medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 8.9.1 - Reflected Cross-Site Scripting

Dec 6, 2021 Patched in 8.9.2 (778d)

CVE-2018-20556high · 8.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Booking Calendar <= 8.4.3 - SQL injection

Dec 28, 2018 Patched in 8.4.4 (1852d)

WF-6f36d866-aa94-478b-8b62-0906bc95e413-bookinghigh · 8.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Booking Calendar <= 6.2 - Cross-Site Request Forgery leading to Cross-Site Scripting

Aug 1, 2016 Patched in 6.2.1 (2731d)

WF-e865324e-a2a2-40fb-8c6a-a89317b59c8c-bookinghigh · 8.8Cross-Site Request Forgery (CSRF)

Booking Calendar <= 6.2 - Cross-Site Request Forgery to SQL Injection

Aug 1, 2016 Patched in 6.2.1 (2731d)

WF-ef9d256b-9156-4172-8892-29a26beddb71-bookinghigh · 7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Booking Calendar <= 6.2 - Authenticated (Editor+) SQL Injection

Aug 1, 2016 Patched in 6.2.1 (2731d)

WF-f0b25726-0b8e-4fce-a986-5f1e176da75a-bookingmedium · 4.3Cross-Site Request Forgery (CSRF)

Booking Calendar < 4.1.6 - Cross-Site Request Forgery

Aug 1, 2014 Patched in 4.1.6 (3462d)

Code Analysis

Analyzed Mar 16, 2026

Booking Calendar Code Analysis

Dangerous Functions

Raw SQL Queries

144 prepared

Unescaped Output

533

5114 escaped

Nonce Checks

Capability Checks

File Operations

External Requests

Bundled Libraries

Dangerous Functions Found

unserialize$booking_gcal_events_form_fields = unserialize( $booking_gcal_events_form_fields );core\admin\wpbc-toolbars.php:958

unserialize$booking_gcal_events_form_fields = unserialize( $booking_gcal_events_form_fields );core\sync\wpbc-gcal-class.php:423

unserializereturn unserialize( strtolower( serialize( $array ) ) );includes\_functions\str_regex.php:83

Bundled Libraries

TinyMCEjQuery

SQL Query Safety

91% prepared158 total queries

Output Escaping

91% escaped5647 total outputs

Data Flows

11 unsanitized

Data Flow Analysis

25 flows11 with unsanitized paths

wpbc_toolbar_search_by_id__top_form (core\admin\wpbc-toolbars.php:1244)

Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized

Attack Surface

Booking Calendar Attack Surface

Entry Points9

Unprotected0

AJAX Handlers 2

authwp_ajax_wpbc_save_calendar_skinincludes\elementor-booking-form\wpbc-elementor.php:211

authwp_ajax_wpbc_deactivate_feedbackincludes\_feedback_deactivation\feedback.php:39

Shortcodes 7

[bookingflextimeline] core\timeline\v2\wpbc-class-timeline_v2.php:3536

[wpbc_test_dates_functions] core\wpbc_functions_dates.php:635

[booking] includes\fontend\class-fe-shortcodes.php:29

[bookingcalendar] includes\fontend\class-fe-shortcodes.php:30

[bookingform] includes\fontend\class-fe-shortcodes.php:31

[wpbc] includes\_capacity\confirmation_page.php:60

[booking_confirm] includes\_capacity\confirmation_page.php:63

WordPress Hooks 208

actionwpbc_after_settings_contentcore\admin\api-settings.php:38

filterwpbc_settings_validate_fields_before_savingcore\admin\api-settings.php:2134

actionwpbc_menu_createdcore\admin\page-email-approved.php:853

actionwpbc_menu_createdcore\admin\page-email-deleted.php:848

actionwpbc_menu_createdcore\admin\page-email-deny.php:848

actionwpbc_menu_createdcore\admin\page-email-new-admin.php:815

actionwpbc_menu_createdcore\admin\page-email-new-visitor.php:809

actionwpbc_menu_createdcore\admin\page-email-trash.php:856

actionwpbc_menu_createdcore\admin\page-ics-export.php:434

actionwpbc_menu_createdcore\admin\page-ics-general.php:636

filterwpbc_fields_before_saving_to_db__general_synccore\admin\page-ics-general.php:665

filterwpbc_fields_after_saving_to_dbcore\admin\page-ics-general.php:697

actionwpbc_menu_createdcore\admin\page-ics-import.php:492

actionwpbc_show_debugcore\admin\page-ics-import.php:763

actionwpbc_menu_createdcore\admin\page-import-gcal.php:791

filterwpbc_fields_after_saving_to_dbcore\admin\page-import-gcal.php:847

actionwpbc_menu_createdcore\admin\page-new.php:161

actionwpbc_menu_createdcore\admin\page-settings.php:1109

actionwpbc_menu_createdcore\admin\page-timeline.php:141

actionwp_dashboard_setupcore\admin\wpbc-dashboard.php:213

actioninitcore\admin\wpbc-gutenberg.php:35

actionwpbc_hook_settings_page_footercore\admin\wpbc-settings-functions.php:66

actionwpbc_define_nav_tabscore\admin\wpbc-sql.php:43

filterupgrader_post_installcore\any\activation.php:55

filterplugin_action_linkscore\any\activation.php:58

filterplugin_row_metacore\any\activation.php:60

actioninitcore\any\activation.php:239

filterphpmailer_initcore\any\api-emails.php:40

actionwp_mail_failedcore\any\api-emails.php:42

actionadmin_menucore\any\class-admin-menu.php:69

actionadmin_menucore\any\class-admin-menu.php:71

actionwpbc_after_settings_contentcore\any\class-admin-settings-api.php:105

actionadmin_enqueue_scriptscore\any\class-css-js.php:20

actionwp_enqueue_scriptscore\any\class-css-js.php:21

actionwpbc_load_js_on_admin_pagecore\any\class-css-js.php:23

actionwpbc_load_css_on_admin_pagecore\any\class-css-js.php:24

actioninitcore\class\wpbc-class-notices.php:39

actionwpbc_hook_booking_page_headercore\class\wpbc-class-notices.php:42

actionwpbc_hook_add_booking_page_headercore\class\wpbc-class-notices.php:43

actionwpbc_hook_settings_page_headercore\class\wpbc-class-notices.php:44

actionadmin_menucore\class\wpbc-class-welcome.php:35

actionadmin_initcore\class\wpbc-class-welcome.php:37

actionload-dashboard_page_wpbc-aboutcore\class\wpbc-class-welcome.php:39

actionwpbc_enqueue_js_filescore\timeline\v2\wpbc-class-timeline_v2.php:3557

actionwpbc_enqueue_css_filescore\timeline\v2\wpbc-class-timeline_v2.php:3577

actionwpbc_admin_show_top_noticecore\wpbc-debug.php:261

actionphpmailer_initcore\wpbc-emails.php:91

filterwpbc_email_api_get_subject_beforecore\wpbc-emails.php:440

filterwpbc_email_api_get_content_beforecore\wpbc-emails.php:469

filterwpbc_email_api_get_content_aftercore\wpbc-emails.php:486

filterwpbc_email_api_get_headers_aftercore\wpbc-emails.php:536

filterwpbc_email_api_is_allow_sendcore\wpbc-emails.php:561

actionwpbc_email_sending_errorcore\wpbc-emails.php:602

actionwpbc_enqueue_js_filescore\wpbc-js-vars.php:261

filterscript_loader_tagcore\wpbc-js.php:63

filterwpbc_is_load_script_on_this_pagecore\wpbc-js.php:333

actionplugins_loadedcore\wpbc-translation.php:28

filterlocalecore\wpbc-translation.php:73

filterplugin_localecore\wpbc-translation.php:363

filtergettext_bookingcore\wpbc-translation.php:1620

filtergettext_booking-managercore\wpbc-translation.php:1621

actioninitcore\wpbc.php:46

action_admin_menucore\wpbc.php:69

actionadmin_footercore\wpbc.php:71

actionwp_enqueue_scriptscore\wpbc.php:77

actionwp_enqueue_scriptscore\wpbc.php:78

actionwp_footercore\wpbc.php:79

actionadmin_noticescore\wpbc.php:503

actionadmin_noticescore\wpbc.php:505

actionwpbc_track_new_bookingcore\wpbc_functions.php:764

actionwpbc_set_booking_pendingcore\wpbc_functions.php:765

actionwpbc_set_booking_approvedcore\wpbc_functions.php:766

actionwpbc_move_booking_to_trashcore\wpbc_functions.php:767

actionwpbc_restore_booking_from_trashcore\wpbc_functions.php:768

actionwpbc_delete_booking_completelycore\wpbc_functions.php:769

actionwpbc_set_booking_as_readcore\wpbc_functions.php:770

actionwpbc_set_booking_as_unreadcore\wpbc_functions.php:771

actionelementor/widgets/registerincludes\elementor-booking-form\wpbc-elementor.php:28

actionelementor/elements/categories_registeredincludes\elementor-booking-form\wpbc-elementor.php:44

actionelementor/editor/after_enqueue_stylesincludes\elementor-booking-form\wpbc-elementor.php:59

actionelementor/editor/after_enqueue_scriptsincludes\elementor-booking-form\wpbc-elementor.php:83

actionelementor/controls/registerincludes\elementor-booking-form\wpbc-elementor.php:107

actionelementor/controls/registerincludes\elementor-booking-form\wpbc-elementor.php:127

actionelementor/controls/registerincludes\elementor-booking-form\wpbc-elementor.php:144

actionelementor/controls/registerincludes\elementor-booking-form\wpbc-elementor.php:161

filterelementor/widget/render_contentincludes\elementor-booking-form\wpbc-elementor.php:267

actionelementor/frontend/after_register_scriptsincludes\elementor-booking-form\wpbc-elementor.php:309

actionelementor/frontend/after_register_stylesincludes\elementor-booking-form\wpbc-elementor.php:313

filterwpbc_force_client_assetsincludes\elementor-booking-form\wpbc-elementor.php:317

actioninitincludes\fontend\class-fe-shortcodes.php:21

filterwpbc_booking_form__body_html__before_postprocessincludes\fontend\hooks\class-fe-bfb-settings-hooks.php:93

filterwpbc_booking_form__wrapped_html__before_inline_scriptsincludes\fontend\hooks\class-fe-bfb-settings-hooks.php:181

filterwpbc_booking_form__wrapped_html__before_inline_scriptsincludes\fontend\hooks\class-fe-bfb-settings-hooks.php:253

actionwpbc_enqueue_js_filesincludes\page-availability\availability__class.php:29

actionwpbc_enqueue_css_filesincludes\page-availability\availability__class.php:30

actionwpbc_hook_settings_page_footerincludes\page-availability\availability__class.php:32

actionwpbc_toolbar_top_tabs_insertincludes\page-availability\availability__page.php:28

actionwpbc_menu_createdincludes\page-availability\availability__page.php:388

actionwpbc_menu_createdincludes\page-availability\availability__page.php:452

actionwp_error_addedincludes\page-bookings\bookings__actions.php:2281

actionwpbc_enqueue_js_filesincludes\page-bookings\bookings__listing.php:42

actionwpbc_enqueue_css_filesincludes\page-bookings\bookings__listing.php:43

actionwpbc_hook_settings_page_footerincludes\page-bookings\bookings__listing.php:45

filterwpbc_search_booking_by_keywordincludes\page-bookings\bookings__listing.php:385

actionwpbc_menu_createdincludes\page-bookings\bookings__page.php:291

filterwp_php_error_messageincludes\page-bookings\bookings__sql.php:2689

actioncheck_ajax_refererincludes\page-bookings\bookings__sql.php:2708

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\booking_cost.php:111

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\booking_note.php:99

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\change_locale.php:138

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\change_resource.php:150

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\change_resource.php:153

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\duplicate_booking.php:151

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\duplicate_booking.php:154

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\payment_request.php:140

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\booking_action\payment_status.php:139

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\export_csv.php:196

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\import_google_calendar.php:170

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\selected_bookings_approve.php:133

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\selected_bookings_delete.php:141

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\selected_bookings_pending.php:141

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\selected_bookings_read.php:131

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\selected_bookings_restore.php:140

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\selected_bookings_trash.php:142

actionwpbc_hook_booking_template__hidden_templatesincludes\page-bookings\listing_actions\selected_bookings_unread.php:131

actionhook__wpbc_ui__top_horisontal_nav__endincludes\page-bookings\listing_filters\bo_listing_toolbar.php:61

actionwpbc_hook_settings_page_footerincludes\page-form-simple\form_simple__auto_show_timeslots.php:45

actionwpbc_hook_settings_page_footerincludes\page-form-simple\form_simple__preview_templates.php:35

filterwpbc_form_gen_free_fields_selectionincludes\page-form-simple\form_simple__timeslots.php:52

actionwpbc_settings_form_page_after_valuesincludes\page-form-simple\form_simple__timeslots.php:78

actionwpbc_hook_settings_page_footerincludes\page-form-simple\form_simple__timeslots.php:889

actionwpbc_menu_createdincludes\page-form-simple\page-form-simple.php:1494

actionadmin_enqueue_scriptsincludes\page-form-simple\page-form-simple.php:1521

actionwpbc_menu_createdincludes\page-resource-free\page-resource-free.php:441

filterwpbc_settings_color_themes_validate_fields_before_savingincludes\page-settings-color-themes\page-settings-color-themes.php:40

actionwpbc_after_settings_contentincludes\page-settings-color-themes\page-settings-color-themes.php:65

actionwpbc_menu_createdincludes\page-settings-color-themes\page-settings-color-themes.php:599

actionwpbc_after_settings_contentincludes\page-settings-form-options\page-settings-form-options.php:42

filterwpbc_settings_form_options_validate_fields_before_savingincludes\page-settings-form-options\page-settings-form-options.php:223

actionwpbc_menu_createdincludes\page-settings-form-options\page-settings-form-options.php:499

actioninitincludes\page-setup\setup_steps.php:25

actionwpbc_after_wpbc_page_top__header_tabsincludes\page-setup\setup_steps.php:28

actioninitincludes\page-setup\setup_steps.php:500

actionwpbc_enqueue_js_filesincludes\page-setup\setup_templates.php:28

actionwpbc_enqueue_css_filesincludes\page-setup\setup_templates.php:29

actionwpbc_hook_settings_page_footerincludes\page-setup\setup_templates.php:31

filteradmin_body_classincludes\page-setup\setup__page.php:92

actionwpbc_menu_createdincludes\page-setup\setup__page.php:317

actioninitincludes\page-setup\setup__page.php:362

actionwpbc_enqueue_js_filesincludes\print\bookings_print.php:27

actionwpbc_enqueue_css_filesincludes\print\bookings_print.php:28

actionwpbc_hook_settings_page_footerincludes\print\bookings_print.php:30

actioninitincludes\publish\wpbc-create-pages.php:406

actioninitincludes\publish\wpbc-create-pages.php:481

actioninitincludes\publish\wpbc-create-pages.php:550

actionwpbc_hook_settings_page_before_content_tableincludes\publish\wpbc-publish-shortcode.php:193

actionwpbc_hook_settings_page_footerincludes\publish\wpbc-publish-shortcode.php:377

actioninitincludes\save-load-option\save-load-option.php:53

actionadmin_enqueue_scriptsincludes\save-load-option\save-load-option.php:54

actionplugins_loadedincludes\save-load-option\save-load-option.php:358

actioninitincludes\save-user-meta\save-user-meta.php:26

actionadmin_enqueue_scriptsincludes\save-user-meta\save-user-meta.php:27

actionplugins_loadedincludes\save-user-meta\save-user-meta.php:157

actionadmin_enqueue_scriptsincludes\ui_modal__shortcodes\shortcode_tpl_js_loader.php:41

actionadmin_footerincludes\ui_modal__shortcodes\shortcode_tpl_js_loader.php:63

actioninitincludes\ui_modal__shortcodes\tiny-button-popup.php:38

filtermce_external_pluginsincludes\ui_modal__shortcodes\tiny-button-popup.php:60

filtermce_buttonsincludes\ui_modal__shortcodes\tiny-button-popup.php:64

actionedit_page_formincludes\ui_modal__shortcodes\tiny-button-popup.php:70

actionadmin_headincludes\ui_modal__shortcodes\tiny-button-popup.php:71

actionadmin_footerincludes\ui_modal__shortcodes\tiny-button-popup.php:72

actioncustomize_controls_print_footer_scriptsincludes\ui_modal__shortcodes\tiny-button-popup.php:78

actioncustomize_controls_print_footer_scriptsincludes\ui_modal__shortcodes\tiny-button-popup.php:79

actioncustomize_controls_print_footer_scriptsincludes\ui_modal__shortcodes\tiny-button-popup.php:80

actionwpbc_define_nav_tabsincludes\ui_settings\class-menu-structure.php:68

actionwpbc_define_nav_tabsincludes\ui_settings\class-menu-structure.php:72

actionwpbc_ui__right_vertical_sidebar_contentincludes\ui_settings\class-menu-structure.php:75

actionwpbc_ui__right_vertical_sidebar_compact_contentincludes\ui_settings\class-menu-structure.php:78

filteradmin_body_classincludes\ui_settings\class-menu-structure.php:271

actionwpbc_page_structure_showincludes\ui_settings\class-page-structure.php:68

filteradmin_body_classincludes\ui_settings\parts\ui__nav_top.php:243

actionhook__wpbc_ui__top_horisontal_nav__endincludes\ui_settings\parts\ui__timeline_toolbar.php:49

actionwpbc_booking_approvedincludes\_booking_hash\booking_hash.php:245

actionwpbc_booking_action__approvedincludes\_booking_hash\booking_hash.php:246

actionwpbc_booking_trashincludes\_booking_hash\booking_hash.php:247

actionwpbc_booking_action__trashincludes\_booking_hash\booking_hash.php:248

filterwpbc_booking_form_html__create_captchaincludes\_capacity\captcha_simple_text.php:265

actioninitincludes\_capacity\confirmation_page.php:65

actionwpbc_enqueue_js_filesincludes\_feedback\feedback.php:146

actionwpbc_enqueue_css_filesincludes\_feedback\feedback.php:147

actionwpbc_hook_settings_page_footerincludes\_feedback\feedback.php:149

actioncurrent_screenincludes\_feedback_deactivation\feedback.php:27

actionadmin_enqueue_scriptsincludes\_feedback_deactivation\feedback.php:34

actionadmin_footerincludes\_feedback_deactivation\feedback.php:46

actionadmin_bar_menuincludes\_functions\admin_top_bar.php:324

filterwpbc_replace_params_for_bookingincludes\_functions\booking_data__get.php:580

filterscript_loader_tagincludes\_functions\calendar_scripts.php:194

filterwp-optimize-minify-default-exclusionsincludes\_functions\nonce_func.php:150

filterrocket_delay_js_exclusionsincludes\_functions\nonce_func.php:207

filterrocket_defer_js_exclusionsincludes\_functions\nonce_func.php:212

filterrocket_defer_inline_exclusionsincludes\_functions\nonce_func.php:217

actionwpbc_enqueue_js_filesincludes\_pagination\pagination.php:84

actionwpbc_enqueue_css_filesincludes\_pagination\pagination.php:85

actionwpbc_hook_settings_page_footerincludes\_pagination\pagination.php:129

actionwpbc_enqueue_css_filesincludes\_toolbar_ui\toolbar_ui.php:1469

actionwpbc_enqueue_js_filesincludes\_toolbar_ui\toolbar_ui.php:1495

filterwpbc_booking_form_content__after_loadincludes\_toolbar_ui\ui__form_steps_timeline.php:156

actionadmin_enqueue_scriptsincludes\_tour\wpbc_tour.php:131

Maintenance & Trust

Booking Calendar Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4

Last updatedFeb 10, 2026

PHP min version5.6

Downloads4.8M

Community Trust

Rating94/100

Number of ratings646

Active installs50K

Alternatives

Booking Calendar Alternatives

Events Manager – Calendar, Bookings, Tickets, and more!

events-manager

Events calendar with bookings, scheduling, appointments, event registration, tickets, recurring events, and venue management.

70K 34 CVEs

Booking Ultra Pro Appointments Booking Calendar Plugin

booking-ultra-pro

Powerful Booking Plugin with amazing dashboard to manage all of your appointments & bookings online.

500 1 unpatched

Doctor Appointment Booking Plugin – EMSB

emsb-service-booking

Allow your customers to book your service like appointment, event, reservation, etc. Manage your bookings through wp admin dashboard.

80 No CVEs

Appointment Booking Calendar

creavi-booking-service

100

Easy appointment booking system for any service. Create services, manage availability, and accept bookings with a simple booking calendar.

10 No CVEs

LatePoint – Calendar Booking Plugin for Appointments and Events

latepoint

Optimize your appointment scheduling with our plugin. Sync calendars, automate reminders, and keep your bookings organized.

100K 2 unpatched

Developer Profile

Booking Calendar Developer Profile

wpdevelop

25 plugins · 59K total installs

trust score

Avg Security Score

93/100

Avg Patch Time

437 days

View full developer profile

Detection Fingerprints

How We Detect Booking Calendar

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths

/wp-content/plugins/booking/js/captcha/captcha.js/wp-content/plugins/booking/css/captcha.css

Script Paths

/wp-content/plugins/booking/js/captcha/captcha.js

HTML / DOM Fingerprints

CSS Classes

booking_form_theme

HTML Comments

FixIn: 10.0.0.54.

JS Globals

wpdevReallySimpleCaptcha

FAQ

Booking Calendar Security & Risk Analysis

Is Booking Calendar Safe to Use in 2026?

Mostly Safe

Key Concerns

Booking Calendar Security Vulnerabilities

CVEs by Year

Severity Breakdown

Booking Calendar Code Analysis

Dangerous Functions Found

Bundled Libraries

SQL Query Safety

Output Escaping

Data Flow Analysis

Booking Calendar Attack Surface

AJAX Handlers 2

Shortcodes 7

Booking Calendar Maintenance & Trust

Maintenance Signals

Community Trust

Booking Calendar Alternatives

Events Manager – Calendar, Bookings, Tickets, and more!

Booking Ultra Pro Appointments Booking Calendar Plugin

Doctor Appointment Booking Plugin – EMSB

Appointment Booking Calendar

LatePoint – Calendar Booking Plugin for Appointments and Events

Booking Calendar Developer Profile

How We Detect Booking Calendar

Asset Fingerprints

HTML / DOM Fingerprints

Frequently Asked Questions about Booking Calendar