BA Book Everything

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 73% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

10 of the last 14 four- and five-star reviews came from accounts created within a month of posting the review.

Registering a wp.org account just to leave a review is common and often entirely legitimate. The share here is unusually high for the sample, so it's worth keeping in mind while reading the reviews.

1. ★★★★★ libertaddd

   11mo ago

   Excellent booking plugin, I use it in several projects. Also great support, thank you!

   Read on wp.org ↗
2. ★★★★★ Vu Tru So

   11mo ago

   Plugin has issues without response

   Read on wp.org ↗
3. ★★★★★ Celestel

   2.0y ago

   Very good and flexible plugin with knowledgeable and excellent support.

   Read on wp.org ↗
4. ★★★★★ bhaviagastya

   2.3y ago

   I’m using it from last 1 year and i really liked it.

   Read on wp.org ↗
5. ★★★★★ nahualliart

   2.4y ago

   Something happen to this plugin.After a week trying to figuring out what was the issue with our site, and realizing that every other plugin works just fine… we finally find out that not only the main issue that make the site break in every update, but the root of getting hundreds of bots register in our site, was this plugin.We try to reach support but was impossible, this plugin is lost.

   Read on wp.org ↗
6. ★★★★★ saligin

   2.4y ago

   Attention is urgently needed concerning a WordPress plugin recently identified to contain embedded malicious code. This plugin, upon detection, plays the national anthem of Ukraine for users who have set Russian as their primary language within their site’s settings. This act not only infringes upon user consent but also crosses ethical boundaries by embedding politically motivated content within a tool presumably designed for broader, neutral purposes. Embedding such content based on the user’s language setting not only constitutes a breach of privacy but also represents a gross misuse of the platform for pushing unsolicited political messages. This behavior is deeply concerning as it goes against the core values of software development and the WordPress community, which prides itself on creating an inclusive, respectful, and user-centric digital environment. The introduction of hidden functionalities, especially those that carry a political undertone, damages the trust between plugin developers, the WordPress community, and the wider user base. Trust is a cornerstone of digital interactions, and once eroded, it can lead to a significant setback in user engagement and platform credibility. Moreover, the act of singling out users based on language or any other demographic characteristic to subject them to unsolicited content is divisive and potentially harmful. It not only alienates users but also fosters an environment where divisive tactics are normalized, which can have broader social implications beyond the immediate discomfort or offense caused. We stand firmly against the use of WordPress plugins, or any digital tools, as a medium for unsolicited political messages, discrimination, or any form of cyber manipulation. The digital space, especially platforms like WordPress that empower expression and creativity, should remain neutral grounds promoting unity, respect, and constructive dialogue. Users and developers alike are urged to exercise caution and to uphold the principles of ethical conduct, respecting the diversity of the global community. Plugins should enhance functionality and user experience without hidden agendas or divisive content. For those who have inadvertently installed or interacted with this plugin, we recommend immediate removal and a thorough security check of your WordPress site to ensure no residual malicious code remains. Let’s work together to maintain a safe, respectful, and inclusive digital environment for all WordPress users.

   Read on wp.org ↗
7. ★★★★★ nikka555

   2.8y ago

   WARNING! In the files of this plugin there is a malicious file that plays once a day Ukraina.mp3 and blocks all work in WordPress!Licensed themes with this plugin also do not work.Be careful with such parasites.Path: /wp-content/plugins/ba-book-everything/js/sweetalert In the files: sweetalert2.all.jssweetalert2.all.min.jssweetalert2.jssweetalert2.min.js

   Read on wp.org ↗
8. ★★★★★ miminou

   2.8y ago

   It’s a very complete Booking solution, that contains a lot of options and posibilities.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.8.26 Fixed Emogrifier php compatibility issues 1.8.26
2. — Version 1.8.25 Updated integration with Google Maps 1.8.25
3. — Version 1.8.24 Updated the “tested up to” WP version 1.8.24
4. — Version 1.8.23 Fixed an issue with rebuilding the availability calendar 1.8.23
5. — Version 1.8.22 Added an admin option (button) to rebuild the booking item availability calendar 1.8.22
6. — Version 1.8.21 Added an option in the search form to switch between selecting a date range and selecting a single date Added Google captcha and Cloudflare captcha integrations for login/register forms (new option in the BA Settings adm 1.8.21

9 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 BA Book Everything <= 1.8.16 - Missing Authorization ↗
   2026-01-08 CVE-2026-24371 Missing Authorization Affects <= 1.8.16 Patched in 1.8.17
2. Medium · 6.4 BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcode ↗
   2025-12-18 CVE-2025-14449 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.14 Patched in 1.8.15
3. Medium · 6.1 BA Book Everything <= 1.6.20 - Reflected Cross-Site Scripting ↗
   2024-09-30 CVE-2024-47360 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.20 Patched in 1.6.21
4. Medium · 5.3 BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset ↗
   2024-09-23 CVE-2024-8794 Unverified Password Change Affects <= 1.6.20 Patched in 1.6.21
5. High · 8.8 BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover ↗
   2024-09-23 CVE-2024-8795 Cross-Site Request Forgery (CSRF) Affects <= 1.6.20 Patched in 1.6.21
6. Medium · 4.4 BA Book Everything <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-04-16 CVE-2024-32598 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.8 Patched in 1.6.9
7. Medium · 6.4 BA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2024-04-15 CVE-2024-3672 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.8 Patched in 1.6.9
8. Critical · 9.9 BA Book Everything <= 1.6.4 - Authenticated (Contributor+) SQL Injection ↗
   2024-04-12 CVE-2024-32125 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.6.4 Patched in 1.6.5
9. Medium · 6.1 BA Book Everything Plugin < 1.3.25 - Cross-Site Scripting and Cross-Frame Scripting ↗
   2020-09-30 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.3.25 Patched in 1.3.25

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 26 languages, 1 at 90% or more

Plus 2 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-02-23 9K+ → 10K+ up after 58 days in tier
2. 2023-12-27 8K+ → 9K+ up after 94 days in tier
3. 2023-09-24 7K+ → 8K+ up after 88 days in tier
4. 2023-06-28 6K+ → 7K+ up after 89 days in tier
5. 2023-03-31 5K+ → 6K+ up after 87 days in tier
6. 2023-01-03 4K+ → 5K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Booqable Rental Plugin 1K+ installs · 4.0★ · 2 shared tags B
• Twice Commerce – Easy Rental Booking System 400+ installs · 4.1★ · 2 shared tags B
• Rezgo Online Booking 300+ installs · 3.7★ · 2 shared tags B
• Bukza 200+ installs · 4.1★ · 2 shared tags B
• Understory 100+ installs · 3.6★ · 2 shared tags B
• Hostfully Booking Widget 100+ installs · 3.6★ · 2 shared tags D

Embed this report card

Drop a live Pulse card for BA Book Everything into a readme, a review or a deck. It updates itself.

BA Book Everything: 10K+ active installs, 4.2★ (20 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/ba-book-everything