Bookit — Booking & Appointment Calendar

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Bookit — Booking & Appointment Calendar

Information

Software Type Plugin
Software Slug bookit (view on wordpress.org)
Software Status Active
Software Author stellarwp
Software Website bookitwp.com
Software Downloads 219,959
Software Active Installs 4,000
Software Record Last Updated June 18, 2026

8 Vulnerabilities

Submit a Vulnerability
Bookit — Booking & Appointment Calendar <= 2.5.1 - Missing Authorization
5.3
CVE-2026-40780
Apr 22, 2026
Researcher: davidfdzmorilla
Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Settings Update
5.3
CVE-2025-12841
Nov 15, 2025
Researcher: Khaled Alenazi (Nxploited)
Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection
7.5
CVE-2025-12633
Nov 11, 2025
Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)
BookIt <=2.4.0 - Price Bypass
4.9
CVE-2024-24715
Jan 31, 2024
Researchers: Debangshu Kundu, Arpeet Rathi
BookIt <= 2.4.3 - Authenticated(Administrator+) SQL Injection
6.6
CVE-2023-50852
Dec 21, 2023
Researcher: Muhammad Daffa
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
BookIt <= 2.3.7 - Authentication Bypass
9.8
CVE-2023-2834
Jun 20, 2023
Researcher: István Márton
Freemius SDK <= 2.4.2 - Missing Authorization Checks
6.3
CVE-2022-4974
Mar 4, 2022
Researchers:
Title Status CVE ID CVSS Researchers Date
Bookit — Booking & Appointment Calendar <= 2.5.1 - Missing Authorization Patched CVE-2026-40780 5.3 davidfdzmorilla April 22, 2026
Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Settings Update Patched CVE-2025-12841 5.3 Khaled Alenazi (Nxploited) November 15, 2025
Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection Patched CVE-2025-12633 7.5 Md. Moniruzzaman Prodhan (NomanProdhan) November 11, 2025
BookIt <=2.4.0 - Price Bypass Patched CVE-2024-24715 4.9 Debangshu Kundu, Arpeet Rathi January 31, 2024
BookIt <= 2.4.3 - Authenticated(Administrator+) SQL Injection Patched CVE-2023-50852 6.6 Muhammad Daffa December 21, 2023
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Patched CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023
BookIt <= 2.3.7 - Authentication Bypass Patched CVE-2023-2834 9.8 István Márton June 20, 2023
Freemius SDK <= 2.4.2 - Missing Authorization Checks Patched CVE-2022-4974 6.3 March 4, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation