Easy Appointment Booking & Scheduling System – Webba Booking Calendar

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Easy Appointment Booking & Scheduling System – Webba Booking Calendar

Information

Software Type Plugin
Software Slug webba-booking-lite (view on wordpress.org)
Software Status Active
Software Author webba-agency
Software Website webba-booking.com
Software Downloads 341,078
Software Active Installs 2,000
Software Record Last Updated August 15, 2026

11 Vulnerabilities

Submit a Vulnerability
Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 - Missing Authorization
5.3
CVE-2026-27409
Jul 1, 2026
Researcher: Legion Hunter
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
Webba Booking <= 6.2.1 - Missing Authorization
4.3
CVE-2025-66530
Dec 15, 2025
Researcher: daroo
Webba Booking <= 6.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-54729
Aug 14, 2025
Researcher: greenhats
Webba Booking <= 5.1.20 - Cross-Site Request Forgery
4.3
CVE-2025-54036
Jul 16, 2025
Researcher: Nguyen Xuan Chien
Webba Booking <= 5.1.20 - Missing Authorization
5.3
CVE-2025-54040
Jul 16, 2025
Researcher: Hiro
Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update
4.3
CVE-2024-8432
Sep 23, 2024
Researcher: Lucio Sá
Webba Booking <= 4.5.33 - Cross-Site Request Forgery
4.3
CVE-2023-51354
Dec 26, 2023
Researcher: Skalucy
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
Webba Booking <= 4.2.21 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE-2021-36847
Apr 15, 2022
Researcher: Asif Nawaz Minhas
Freemius SDK <= 2.4.2 - Missing Authorization Checks
6.3
CVE-2022-4974
Mar 4, 2022
Researchers:
Title Status CVE ID CVSS Researchers Date
Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 - Missing Authorization Patched CVE-2026-27409 5.3 Legion Hunter July 1, 2026
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Patched CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
Webba Booking <= 6.2.1 - Missing Authorization Patched CVE-2025-66530 4.3 daroo December 15, 2025
Webba Booking <= 6.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2025-54729 4.4 greenhats August 14, 2025
Webba Booking <= 5.1.20 - Cross-Site Request Forgery Patched CVE-2025-54036 4.3 Nguyen Xuan Chien July 16, 2025
Webba Booking <= 5.1.20 - Missing Authorization Patched CVE-2025-54040 5.3 Hiro July 16, 2025
Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update Patched CVE-2024-8432 4.3 Lucio Sá September 23, 2024
Webba Booking <= 4.5.33 - Cross-Site Request Forgery Patched CVE-2023-51354 4.3 Skalucy December 26, 2023
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Patched CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023
Webba Booking <= 4.2.21 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2021-36847 5.5 Asif Nawaz Minhas April 15, 2022
Freemius SDK <= 2.4.2 - Missing Authorization Checks Patched CVE-2022-4974 6.3 March 4, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation