The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Booking Calendar Contact Form Plugin | — | Update booking-calendar-contact-form plugin to version 1.1.25, or a newer patched version | Oct 30, 2026 | Jun 15, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub