| Package | Affected versions | Patched versions |
|---|---|---|
| booking calendar | ≤ 9.1 |
The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free