PULSE
LIVE20signals / 24h
ES
FEED
ransomnova reclama a Marpatech · Technologyransomnova reclama a Canal 9 Litoral · AR · Telecommunicationransomqilin reclama a Evergreen Title · US · Financial Servicesransomplay reclama a Tax MT · MT · Business Servicesransomplay reclama a Kreysler & Associates · US · Business Servicesransomnova reclama a La Financière d'Orion (finorion) · FR · Financial Servicesransomchaos reclama a argonautms.com · RU · Technologyransomdragonforce reclama a One Community FCU · US · Financial Servicesransomqilin reclama a RehaVital Gesundheitsservice GmbH · DE · Healthcareransomnova reclama a Tèrra Aventura · PT · Hospitality and Tourismransomnova reclama a Koperasi Karyawan PT Aplikanusa Lintasarta · ID · Telecommunicationransomakira reclama a Novasport s.r.o. · CZ · Consumer Servicesransomakira reclama a Finer & Finer · Consumer Servicesransommorpheus reclama a Kyowa Singapore Pte Ltd · SG · Business Servicesransomnova reclama a Marpatech · Technologyransomnova reclama a Canal 9 Litoral · AR · Telecommunicationransomqilin reclama a Evergreen Title · US · Financial Servicesransomplay reclama a Tax MT · MT · Business Servicesransomplay reclama a Kreysler & Associates · US · Business Servicesransomnova reclama a La Financière d'Orion (finorion) · FR · Financial Servicesransomchaos reclama a argonautms.com · RU · Technologyransomdragonforce reclama a One Community FCU · US · Financial Servicesransomqilin reclama a RehaVital Gesundheitsservice GmbH · DE · Healthcareransomnova reclama a Tèrra Aventura · PT · Hospitality and Tourismransomnova reclama a Koperasi Karyawan PT Aplikanusa Lintasarta · ID · Telecommunicationransomakira reclama a Novasport s.r.o. · CZ · Consumer Servicesransomakira reclama a Finer & Finer · Consumer Servicesransommorpheus reclama a Kyowa Singapore Pte Ltd · SG · Business Services
← All CVEs
CVE WatchJul 8, 2026

CVE-2026-12378

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a

CVSS

8.1

High

EPSS

0.4%

p31

KEV

—

Exploit Today

9

0-100

Published: Jul 8, 2026 · Last modified: Jul 8, 2026

EPSS · 30d
0.2%EPSS · 30 days0.4%
2026-07-082026-07-21
Technical description

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

Official references
Related CVEs

No related CVEs by CWE or product.