WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
booking-and-rental-manager-for-woocommerce
Published
2025-02-23
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.2.7 - Authenticated (Contributor+) PHP Object Injection
Slug
booking-and-rental-manager-for-woocommerce
Published
2025-04-17
Title
Booking and Rental Manager < 2.2.9 - Missing Authorization
Slug
booking-and-rental-manager-for-woocommerce
Published
2025-04-18
Title
Booking and Rental Manager < 2.3.7 - Missing Authorization
Slug
booking-and-rental-manager-for-woocommerce
Published
2025-05-22
Title
Booking and Rental Manager < 2.3.9 - Missing Authorization
Slug
booking-and-rental-manager-for-woocommerce
Published
2025-11-01
Title
Booking and Rental Manager < 2.5.4 - Unauthenticated Stored Cross-Site Scripting
Slug
booking-and-rental-manager-for-woocommerce
Published
2025-09-20
Title
Booking and Rental Manager < 2.5.5 - Authenticated (Contributor+) PHP Object Injection
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-02-09
Title
Booking and Rental Manager < 2.6.0 - Authenticated (Contributor+) PHP Object Injection
Slug
booking-calendar
Published
2018-01-12
Title
Booking Calendar <= 2.1.7 - Authenticated Stored XSS & CSRF
Slug
booking-calendar
Published
2018-06-07
Title
Booking Calendar < 2.2.3 - Parameters Tampering Allowing Arbitrary Prices Change
Slug
booking-calendar
Published
2022-11-21
Title
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
Slug
booking-calendar
Published
2023-01-27
Title
Booking calendar, Appointment Booking System < 3.2.4 - Form Creation/Update/Deletion/Duplication via CSRF
Slug
booking-calendar
Published
2023-01-27
Title
Booking calendar, Appointment Booking System < 3.2.4 - Editor+ Stored XSS
Slug
booking-calendar
Published
2023-04-19
Title
Booking calendar, Appointment Booking System < 3.2.8 - Admin+ SQLi
Slug
booking-calendar
Published
2023-09-12
Title
Booking calendar, Appointment Booking System < 3.2.9 - Multiple Authenticated(Editor+) SQL Injection
Slug
booking-calendar
Published
2023-10-29
Title
Booking Calendar WpDevArt < 3.2.12 - Admin+ SQLi
Slug
booking-calendar
Published
2024-11-25
Title
Booking calendar, Appointment Booking System < 3.2.16 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Slug
booking-calendar
Published
2025-01-06
Title
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
Slug
booking-calendar
Published
2024-12-23
Title
Booking Calendar WpDevArt < 3.2.20 - Authenticated (Contributor+) SQL Injection
Slug
booking-calendar
Published
2025-07-01
Title
Booking calendar, Appointment Booking System < 3.2.18 - Unauthenticated Time-Based SQLi
Slug
booking-calendar
Published
2025-12-15
Title
Booking calendar, Appointment Booking System < 3.2.31 - Missing Authorization
Slug
booking-calendar
Published
2026-03-18
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
Slug
booking-calendar-and-notification
Published
2025-02-28
Title
Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Unauthenticated SQL Injection
Slug
booking-calendar-and-notification
Published
2025-04-03
Title
Booking Calendar and Notification <= 4.0.3 - Authentication Bypass
Slug
booking-calendar-contact-form
Published
2015-05-13
Title
Booking Calendar Contact Form <= 1.0.2 - Multiple Authenticated Vulnerabilities