Plugin icon

WPBookit

wpbookit

Vulnerabilities:

14

Last Updated:

February 23, 2026

Active Installs:

10

Published
Title
Fixed in
CVSS
Published
2026-03-03
Title
WPBookit < 1.0.9 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
Fixed in
Fixed in 1.0.9
CVSS
7.2 (high)
Published
2026-03-03
Title
WPBookit < 1.0.9 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
Fixed in
Fixed in 1.0.9
CVSS
5.3 (medium)
Published
2025-12-12
Title
WPBookit <= 1.0.7 - Customer Deletion via CSRF
Fixed in
No known fix
CVSS
6.5 (medium)
Published
2025-11-20
Title
WPBookit < 1.0.7 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 1.0.7
CVSS
7.2 (high)
Published
2025-07-23
Title
WPBookit < 1.0.7 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
Fixed in
Fixed in 1.0.7
CVSS
9.8 (critical)
Published
2025-07-11
Title
WPBookit < 1.0.5 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 1.0.5
CVSS
8.8 (high)
Published
2025-07-11
Title
WPBookit < 1.0.5 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.0.5
CVSS
9.8 (critical)
Published
2025-05-08
Title
WPBookit < 1.0.3 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover
Fixed in
Fixed in 1.0.3
CVSS
9.8 (critical)
Published
2025-05-08
Title
WPBookit < 1.0.3 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update
Fixed in
Fixed in 1.0.3
CVSS
9.8 (critical)
Published
2025-04-04
Title
WPBookit < 1.0.8 - Missing Authorization
Fixed in
Fixed in 1.0.8
CVSS
5.3 (medium)
Published
2025-03-09
Title
WPBookit < 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Fixed in
Fixed in 1.0.2
CVSS
6.1 (medium)
Published
2025-01-24
Title
WPBookit < 1.6.10 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.6.10
CVSS
9.8 (critical)
Published
2025-01-09
Title
WPBookit < 1.6.6 - Unauthenticated Arbitrary User Password Change
Fixed in
Fixed in 1.6.6
CVSS
9.8 (critical)
Published
2024-12-11
Title
WPBookit <= 1.6.0 - Unauthenticated SQL Injection
Fixed in
No known fix
CVSS
7.5 (high)