WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
booking-calendar-pro
Published
2025-01-06
Title
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
Slug
booking-calendar-pro-payment
Published
2022-11-21
Title
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
Slug
booking-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
booking-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
booking-manager
Published
2023-04-26
Title
Booking Manager < 2.0.29 - Subscriber+ SSRF
Slug
booking-manager
Published
2023-12-21
Title
Booking Manager < 2.1.6 - Authenticated(Contributor+) SQL Injection via Shortcode
Slug
booking-manager
Published
2025-09-19
Title
Booking Manager < 2.1.15 - Contributor+ Booking Deletion
Slug
booking-manager
Published
2025-11-04
Title
Booking Manager < 2.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
booking-package
Published
2021-11-10
Title
Booking Package < 1.5.11 - Reflected Cross-Site Scripting
Slug
booking-package
Published
2022-03-09
Title
Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
Slug
booking-package
Published
2023-08-07
Title
Booking Package < 1.6.02 - Reflected XSS
Slug
booking-package
Published
2024-03-28
Title
Booking Package < 1.6.29 - Unauthenticated Price Manipulation
Slug
booking-package
Published
2025-02-18
Title
Booking Package < 1.6.73 - Reflected Cross-Site Scripting via Locale Parameter
Slug
booking-package
Published
2026-04-21
Title
Booking Package < 1.7.07 - Missing Authorization
Slug
booking-package
Published
2026-04-27
Title
Booking Package < 1.7.07 - Unauthenticated Price Manipulation via 'amount' Parameter
Slug
booking-sms
Published
2017-12-14
Title
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Slug
booking-system
Published
2014-08-01
Title
Booking System - Reflected Cross-Site Scripting (XSS)
Slug
booking-system
Published
2014-08-01
Title
Booking System <= 1.2 - SQL Injection
Slug
booking-system
Published
2015-07-07
Title
Pinpoint Booking System <= 2.0 - Authenticated Blind SQL Injection
Slug
booking-system
Published
2023-01-23
Title
Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi
Slug
booking-system
Published
2023-02-02
Title
Pinpoint Booking System < 2.9.9.2.9 - Admin+ Stored XSS
Slug
booking-system
Published
2023-10-13
Title
Pinpoint Booking System < 2.9.9.4.1 - Arbitrary Settings Update via CSRF
Slug
booking-system
Published
2024-07-15
Title
Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS
Slug
booking-system
Published
2024-09-06
Title
Pinpoint Booking System < 2.9.9.5.1- Authenticated (Subscriber+) SQL Injection
Slug
booking-system
Published
2024-10-15
Title
Pinpoint Booking System < 2.9.9.5.8 - Stored XSS via CSRF