WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bookly-responsive-appointment-booking-tool
Published
2026-10-09
Title
Online Scheduling and Appointment Booking System < 28.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
Slug
bookly-responsive-appointment-booking-tool
Published
2026-10-09
Title
Online Scheduling and Appointment Booking System < 28.5 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
Slug
bookmarkify
Published
2015-08-09
Title
Bookmarkify <= 2.9.2 - Cross-Site Scripting (XSS) & CSRF
Slug
bookme-free-appointment-booking-system
Published
2025-11-24
Title
Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter
Slug
booknetic
Published
2025-02-24
Title
Booknetic < 5.10.4 - Cross-Site Request Forgery
Slug
booknetic
Published
2025-03-05
Title
Booknetic < 4.1.5 - Staff Creation via CSRF
Slug
booknetic
Published
2026-06-01
Title
Booknetic < 5.10.3 - Missing Authorization
Slug
booknetic
Published
2026-10-05
Title
Booknetic < 5.10.3 - Unauthenticated SQL Injection
Slug
bookr
Published
2026-02-13
Title
Appointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification
Slug
books-papers
Published
2022-03-29
Title
Books & Papers <= 0.20210223 - Admin+ Stored Cross-Site Scripting
Slug
bookshelf
Published
2021-06-28
Title
Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
bookster
Published
2024-06-05
Title
Bookster < 1.2.0 - Unauthenticated Appointment Status Update
Slug
bookster
Published
2026-02-17
Title
Bookster – WordPress Appointment Booking Plugin < 2.2.0 - Authenticated (Administrator+) SQL Injection via 'raw'
Slug
booktics
Published
2026-03-09
Title
Booktics < 1.0.17 - Unauthenticated Addons Installation
Slug
booktics
Published
2026-03-09
Title
Booktics < 1.0.17 - Unauthenticated Get Items via REST API endpoints
Slug
booktics
Published
2026-02-02
Title
Booktics < 1.0.17 - Missing Authorization
Slug
booktics
Published
2026-06-29
Title
Booktics < 1.0.22 - Unauthenticated PHP Object Injection
Slug
booktics
Published
2026-08-12
Title
Booktics 1.0.22 - Authenticated (Subscriber+) SQL Injection
Slug
booktics
Published
2026-09-10
Title
Booktics – Booking Calendar for Appointments and Service Businesses < 1.0.24 - Missing Authorization
Slug
booktics
Published
2026-09-10
Title
Booktics – Appointment Booking Calendar for Service Businesses < 1.0.25 - Missing Authorization
Slug
booktics
Published
2026-10-07
Title
Booktics – Appointment Booking Calendar for Service Businesses < 1.0.28 - Missing Authorization
Slug
booktics
Published
2026-10-12
Title
Booktics – Appointment Booking Calendar for Service Businesses < 1.0.29 - Missing Authorization
Slug
booktics
Published
2026-10-12
Title
Booktics – Appointment Booking Calendar for Service Businesses < 1.0.29 - Missing Authorization
Slug
booktics
Published
2026-10-16
Title
Booktics – Appointment Booking Calendar for Service Businesses < 1.0.30 - Unauthenticated SQL Injection
Slug
booktics
Published
2026-10-20
Title
Booktics – Appointment Booking Calendar for Service Businesses < 1.0.31 - Missing Authorization