Themovation vulnerabilities

Products

• Bellevue 1
• QuickCal 1
• QuickCal - Appointment Booking Calendar for WordPress 1

Latest Themovation CVEs

Newest publication first

1. CVE-2026-15984 QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

   Published 2026-09-05

   High·CVSS 7.2 EPSS 0.32%

   The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbit...

2. CVE-2025-39398 WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerability

   Published 2025-05-19

   Medium·CVSS 4.3 EPSS 0.24%

   Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.

3. CVE-2025-32299 WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure Vulnerability

   Published 2025-05-16

   Medium·CVSS 4.3 EPSS 0.35%

   Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Calendar for WordPress:...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.