| #1 | Pinpoint Booking System – Version 2 | 21 | 634 | 328 | 3k+ | | | Missing direct file access protection |
| #2 | Booking Ultra Pro Appointments Booking Calendar Plugin | 21 | 761 | 2,083 | 400 | | | Request data is not unslashed |
| #3 | Business Essentials for Contact Form 7 | 24 | 674 | 403 | 8k+ | | | Text Domain Mismatch |
| #4 | LatePoint – Calendar Booking Plugin for Appointments and Events | 24 | 1,847 | 937 | 100k+ | | | Output is not escaped |
| #5 | Booking for Appointments and Events Calendar – Amelia | 25 | 1,487 | 480 | 90k+ | | | Exception output is not escaped |
| #6 | Online Scheduling and Appointment Booking System – Bookly | 25 | 3,528 | 870 | 60k+ | | | Text Domain Mismatch |
| #7 | Hydra Booking — Appointment Scheduling & Booking Calendar | 25 | 235 | 699 | 2k+ | | | Non-prefixed global variable |
| #8 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | 25 | 958 | 738 | 60k+ | | | Text Domain Mismatch |
| #9 | VikAppointments Services Booking Calendar | 25 | 9,753 | 5,207 | 500 | | | Output is not escaped |
| #10 | Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution | 42 | 111 | 17 | 20k+ | | | Exception output is not escaped |
| #11 | SuperSaaS – online appointment scheduling | 42 | 79 | 10 | 1k+ | | | Text Domain Mismatch |
| #12 | Easy!Appointments | 44 | 47 | 6 | 500 | | | Unsafe printing function |
| #13 | Setmore Appointments | 44 | 45 | 13 | 4k+ | | | Output is not escaped |
| #14 | SimplyBook.me – Booking and reservations calendar | 54 | 31 | 13 | 30k+ | | | Exception output is not escaped |
| #15 | Advanced Appointment Booking & Scheduling | 83 | 11 | 13 | 3k+ | | | Text Domain Mismatch |
| #16 | WPS Bookings for WooCommerce | 88 | 26 | 249 | 4k+ | | | Non-prefixed global variable |
| #17 | Easy Appointments | 99 | 2 | 2 | 10k+ | | | Non-prefixed class |
| #18 | Shore Booking Widget | 99 | 1 | 0 | 1k+ | | | outdated tested upto header |
