Critical severity · published Nov 6, 2023
CVE-2022-47428
WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Booking calendar, Appointment Booking System · WpDevArt
through 3.2.7 · source: vendor
BC
Booking Calendar · Wpdevart
before 3.2.8 · source: NVD, CISA
Affected product
BC
Booking calendar, Appointment Booking System
WpDevArt
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-47428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-47428
Third Party Advisory
https://patchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-6-sql-injection?_s_id=cve
More from Booking calendar, Appointment Booking System
9.8
CVE-2023-24373
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability
8.8
CVE-2023-24407
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability
7.2
CVE-2024-9504
Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
7.1
CVE-2026-25435
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability
6.5
CVE-2026-73395
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability