Plugin icon

Rox Appointment Booking – Event, Calendar & Appointment Scheduling

rox-appointment-booking

Vulnerabilities:

6

Last Updated:

October 18, 2026

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2026-10-30
Title
Rox Appointment Booking < 1.3.2 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
Fixed in
Fixed in 1.3.2
CVSS
8.8 (high)
Published
2026-09-14
Title
Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
Fixed in
Fixed in 1.2.8
CVSS
5.3 (medium)
Published
2026-09-14
Title
Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
Fixed in
Fixed in 1.2.8
CVSS
5.3 (medium)
Published
2026-09-10
Title
Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
Fixed in
Fixed in 1.2.0
CVSS
5.3 (medium)
Published
2026-09-10
Title
Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
Fixed in
Fixed in 1.2.0
CVSS
6.5 (medium)
Published
2026-09-10
Title
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
Fixed in
Fixed in 1.2.3
CVSS
5.3 (medium)