WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
book-press
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
book-press
Published
2025-02-02
Title
BookPress – For Book Authors <= 1.2.7 - Missing Authorization
Slug
book-press
Published
2025-02-03
Title
BookPress – For Book Authors <= 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
book-previewer-for-woocommerce
Published
2026-02-18
Title
Book Previewer for Woocommerce <= 1.0.6 - Missing Authorization
Slug
bookalet
Published
2025-01-16
Title
Bookalet <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
booked
Published
2020-02-29
Title
Booked < 2.2.6 - Broken Authentication to Export Users Data in CSV
Slug
booked
Published
2026-01-29
Title
Booked <= 3.0.0 - Authentication Bypass
Slug
bookify
Published
2025-07-29
Title
Bookify < 1.0.10 - Authenticated (Subscriber+) Privilege Escalation
Slug
bookify
Published
2026-04-23
Title
Bookify – Appointment Booking & Scheduling for WordPress < 1.1.2 - Missing Authorization
Slug
booking
Published
2014-08-01
Title
Booking Calendar <= 4.1.5 - Cross-Site Request Forgery (CSRF)
Slug
booking
Published
2016-08-01
Title
Booking Calendar <= 6.2 - Reflected Cross-Site Scripting (XSS)
Slug
booking
Published
2016-08-01
Title
Booking Calendar <= 6.2 - SQL Injection
Slug
booking
Published
2019-02-14
Title
Booking < 8.4.5.15 - SQL Injection
Slug
booking
Published
2021-12-06
Title
Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting
Slug
booking
Published
2022-04-27
Title
Booking Calendar < 9.1.1 - PHP Object Injection
Slug
booking
Published
2022-09-06
Title
Booking Calendar < 9.2.2 - Arbitrary Translation Update via CSRF
Slug
booking
Published
2023-09-11
Title
Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS
Slug
booking
Published
2023-09-25
Title
Booking Calendar < 9.7.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Slug
booking
Published
2024-02-07
Title
Booking Calendar < 9.9.1 - Unauthenticated SQL Injection
Slug
booking
Published
2024-07-23
Title
WP Booking Calendar < 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode
Slug
booking
Published
2024-08-29
Title
WP Booking Calendar < 10.5.1 - Reflected Cross-Site Scripting
Slug
booking
Published
2024-10-03
Title
WP Booking Calendar < 10.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
booking
Published
2024-10-17
Title
WP Booking Calendar < 10.6.3 - Admin+ Stored XSS
Slug
booking
Published
2024-11-12
Title
WP Booking Calendar < 10.6.5 - Admin+ Stored XSS
Slug
booking
Published
2025-01-13
Title
Booking Calendar < 10.9.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode