Is appointment-hour-booking (WordPress plugin) vulnerable?

WordPress appointment-hour-booking has 8 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.

8advisories
0critical
0on CISA KEV
4no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2019-13505The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.medium6.1=1.1.44–
CVE-2022-4035The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions high7.2<=1.3.72–
CVE-2022-4034The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it posmedium5.8<=1.3.72–
CVE-2021-24712The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.medium5.4<1.3.171.3.17
CVE-2021-24673The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege usermedium4.8<1.3.161.3.16
CVE-2022-1710The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allomedium4.8<1.3.561.3.56
CVE-2022-41692Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.medium4.3<1.3.721.3.72
CVE-2022-4036The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to tmedium5.3<=1.3.72–

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.