Plugin icon

Booking Package

booking-package

Vulnerabilities:

13

Last Updated:

October 15, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-10-13
Title
Booking Package < 1.7.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Fixed in
Fixed in 1.7.30
CVSS
5.5 (medium)
Published
2026-10-13
Title
Booking Package < 1.7.30 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
Fixed in
Fixed in 1.7.30
CVSS
7.5 (high)
Published
2026-10-08
Title
Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure
Fixed in
Fixed in 1.7.30
CVSS
5.3 (medium)
Published
2026-08-24
Title
Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters
Fixed in
Fixed in 1.7.25
CVSS
5.3 (medium)
Published
2026-07-10
Title
Booking Package < 1.7.21 - Unauthenticated SQL Injection via 'email' Form Parameter
Fixed in
Fixed in 1.7.21
CVSS
7.5 (high)
Published
2026-06-05
Title
Booking Package < 1.7.17 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action
Fixed in
Fixed in 1.7.17
CVSS
7.2 (high)
Published
2026-04-27
Title
Booking Package < 1.7.07 - Unauthenticated Price Manipulation via 'amount' Parameter
Fixed in
Fixed in 1.7.07
CVSS
5.3 (medium)
Published
2026-04-21
Title
Booking Package < 1.7.07 - Missing Authorization
Fixed in
Fixed in 1.7.07
CVSS
5.3 (medium)
Published
2025-02-18
Title
Booking Package < 1.6.73 - Reflected Cross-Site Scripting via Locale Parameter
Fixed in
Fixed in 1.6.73
CVSS
6.1 (medium)
Published
2024-03-28
Title
Booking Package < 1.6.29 - Unauthenticated Price Manipulation
Fixed in
Fixed in 1.6.29
CVSS
5.3 (medium)
Published
2023-08-07
Title
Booking Package < 1.6.02 - Reflected XSS
Fixed in
Fixed in 1.6.02
CVSS
7.1 (high)
Published
2022-03-09
Title
Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
Fixed in
Fixed in 1.5.29
CVSS
7.5 (high)
Published
2021-11-10
Title
Booking Package < 1.5.11 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.5.11
CVSS
6.1 (medium)