Skip to content
PluginCanary

Booking Calendar

by wpdevelop · 40,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 2 Nov 2026, 68 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Booking Calendar
Ownership100
Maintenance100
Security60
SupportNo data
Reputation85

How the score works

Quick answers

Is Booking Calendar still maintained?
Yes. Last release 2 Nov 2026, 68 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns Booking Calendar, and has it changed hands?
No change recorded. Main committer wpdevelop since Aug 2009. 4 Nov 2026 · SVN log
Was Booking Calendar removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Booking Calendar safe?
38 known vulnerabilities, all fixed (latest in 11.5). Not on the exploited list. 9 Oct 2026 · Wordfence Intelligence
Is the latest Booking Calendar update safe to install?
No ownership change before 12.0. No one-star spike after it. 2 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
wpdevelop15 Aug 2009 to 2 Nov 2026, 1054 commits

1 committer recorded. No ownership change since 2009.

Maintenance

Last release
2 days ago
Releases, 24 months
68
Tested up to
7.1 current
Requires PHP
5.6 supported 8.2+
Releases per quarter
Releases per quarter for Booking Calendar
Q1 20243
Q2 20244
Q3 20247
Q4 202410
Q1 20258
Q2 20257
Q3 20259
Q4 20253
Q1 202612
Q2 20267
Q3 202614
Q4 20263

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (4 reviews). Lifetime: 4.8.

Average rating per quarter for Booking Calendar
Q3 20254.7
Q4 20255.0
Q1 20265.0
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating rose from 4.7 to 5.0 between Q3 2025 and Q4 2026.

Rating distribution
5 star597
4 star18
3 star8
2 star6
1 star28
Latest low reviews

Security record

22 vulnerabilities in 24 months (38 on record), all patched (latest fixed in 11.5).

Show 38 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
9 Oct 2026Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action5.3<= 11.4.311.5Patched before disclosure
8 Oct 2026Booking Calendar 10.15 - 11.8.2 - Authenticated (Editor+) Information Exposure2.710.15 to 11.8.211.8.3Patched before disclosure
8 Oct 2026Booking Calendar < 11.8 - Unauthenticated Information Exposure5.3< 11.811.8Patched before disclosure
2 Oct 2026Booking Calendar <= 11.8.4 - Unauthenticated Duplicate Slot Booking5.3<= 11.8.411.92
21 Sep 2026Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter6.1<= 11.8.311.8.4Patched before disclosure
17 Sep 2026Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter6.1<= 11.8.211.8.3Patched before disclosure
17 Sep 2026Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter7.2<= 11.8.211.8.3Patched before disclosure
16 Sep 2026Booking Calendar <= 11.7 - Missing Authorization5.3<= 11.711.8Patched before disclosure
27 Jul 2026Booking Calendar <= 11.4.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 11.4.211.4.3Patched before disclosure
17 Feb 2026Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification4.3<= 10.14.1410.14.15Patched before disclosure
14 Feb 2026Booking Calendar <= 10.14.15 - Authenticated (Editor+) SQL Injection4.9<= 10.14.1510.14.16Patched before disclosure
30 Jan 2026Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure5.3<= 10.14.1310.14.14Patched before disclosure
15 Jan 2026Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure4.3<= 10.14.1110.14.12Patched before disclosure
8 Jan 2026Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure5.3<= 10.14.1010.14.11Patched before disclosure
15 Dec 2025Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check7.5<= 10.14.810.14.9Patched before disclosure
4 Dec 2025Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode6.4<= 10.14.610.14.7Patched before disclosure
13 Nov 2025Booking Calendar <= 10.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 10.14.710.14.8Patched before disclosure
27 Aug 2025Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 10.14.110.14.2n/a
16 May 2025Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode6.4<= 10.11.110.11.2Patched before disclosure
11 Feb 2025WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation5.3<= 10.1010.10.1Patched before disclosure
13 Jan 2025Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode6.4<= 10.9.210.9.3Patched before disclosure
14 Nov 2024WP Booking Calendar <= 10.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 10.6.410.6.5Patched before disclosure
17 Oct 2024WP Booking Calendar <= 10.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 10.6.210.6.3Patched before disclosure
3 Oct 2024WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 10.610.6.1Patched before disclosure
29 Aug 2024WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting6.1<= 10.510.5.1Patched before disclosure

Changelog mentions of security fixes: 11.5 (security); 11.6 (security, authorization); 11.7 (security); 11.8 (security); 11.8.1 (security, authorization).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

40,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Booking Calendar
4 May 202621,625
11 May 202625,626
18 May 20267,509
25 May 20264,268
1 Jun 20263,346
8 Jun 20263,137
15 Jun 20262,772
22 Jun 202622,965
29 Jun 202620,152
6 Jul 202610,196
13 Jul 202660,788
20 Jul 202624,520
27 Jul 20266,535
3 Aug 202625,849
10 Aug 20264,307
17 Aug 202621,632
24 Aug 202624,392
31 Aug 202624,390
7 Sep 202641,408
14 Sep 202664,168
21 Sep 20269,075
28 Sep 202620,272
5 Oct 202610,910
12 Oct 202624,081
19 Oct 20265,189
26 Oct 20265,551
2 Nov 2026706

Weekly downloads over the last 4 weeks are 52% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

SimplyBook.meScore 100 · 30,000+MotoPress Hotel Booking StylesScore 100 · 10,000+MotoPress Hotel Booking for ElementorScore 100 · 10,000+EMCScore 93 · 10,000+WP Simple Booking CalendarScore 93 · 10,000+

Facts

Version12.0
Authorwpdevelop
Added15 Aug 2009
Last updated2 Nov 2026
Active installs40,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHP5.6
CategoryBookings & Scheduling > Appointment Scheduling
Tagsbooking form, online booking, booking calendar, appointment booking, availability calendar

Other plugins by this author: Booking Manager - Sync WP Booking Calendar - Import Events, Export Bookings to ICS Calendar, Secure Downloads, Email Reminders

Questions

Is Booking Calendar still maintained?

Yes. Last release 2 Nov 2026, 68 releases in the last 24 months.

Who owns Booking Calendar, and has it changed hands?

No change recorded. Main committer wpdevelop since Aug 2009.

Was Booking Calendar removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Booking Calendar safe?

38 known vulnerabilities, all fixed (latest in 11.5). Not on the exploited list.

Is the latest Booking Calendar update safe to install?

No ownership change before 12.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue