CVE-2026-18496

MediumCVSS 5.3/10Last modified Oct 13, 2026

Description

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
wpdevelop	Booking Calendar	<= 11.4.3

References

Timeline

Published: Oct 10, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-184977.1A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font CVE-2026-184998.1IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.CVE-2026-18507.5Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.CVE-2026-185008.1@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({CVE-2026-185016.4The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to CVE-2026-185032.4Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when CVE-2026-185045.3fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass w CVE-2026-185055.4IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter CVE-2026-185084.4A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated CVE-2026-185097.1IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This CVE-2026-18516.4The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all version CVE-2026-185107.2The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via