WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bookit
Published
2023-12-21
Title
BookIt < 2.4.4 - Authenticated(Administrator+) SQL Injection
Slug
bookit
Published
2024-01-31
Title
BookIt <= 2.4.0 - Price Bypass
Slug
bookit
Published
2025-11-15
Title
Bookit < 2.5.1 – Unauthenticated Settings Update
Slug
bookit
Published
2025-11-11
Title
Booking Calendar | Appointment Booking | Bookit < 2.5.1 - Missing Authorization to Unauthenticated Stripe Connection
Slug
bookly-responsive-appointment-booking-tool
Published
2018-02-10
Title
Bookly #1 WordPress Booking Plugin (Lite) < 14.5 – Unauthenticated Blind Stored XSS
Slug
bookly-responsive-appointment-booking-tool
Published
2021-11-08
Title
Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting
Slug
bookly-responsive-appointment-booking-tool
Published
2023-03-17
Title
Bookly < 21.6 - Unauthenticated Stored XSS
Slug
bookly-responsive-appointment-booking-tool
Published
2023-06-01
Title
Bookly < 21.8 - Admin+ Stored Cross-Site Scripting via service titles
Slug
bookly-responsive-appointment-booking-tool
Published
2023-09-25
Title
Bookly < 22.4 - Admin+ SQLi
Slug
bookly-responsive-appointment-booking-tool
Published
2023-11-06
Title
Bookly < 22.5 - Admin+ Stored XSS
Slug
bookly-responsive-appointment-booking-tool
Published
2024-06-10
Title
WordPress Online Booking and Scheduling Plugin – Bookly < 23.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
Slug
bookmarkify
Published
2015-08-09
Title
Bookmarkify <= 2.9.2 - Cross-Site Scripting (XSS) & CSRF
Slug
bookme-free-appointment-booking-system
Published
2025-11-24
Title
Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter
Slug
booknetic
Published
2025-02-24
Title
Booknetic <= 4.0.9 - Cross-Site Request Forgery
Slug
booknetic
Published
2025-03-05
Title
Booknetic < 4.1.5 - Staff Creation via CSRF
Slug
bookr
Published
2026-02-13
Title
Appointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification
Slug
books-papers
Published
2022-03-29
Title
Books & Papers <= 0.20210223 - Admin+ Stored Cross-Site Scripting
Slug
bookshelf
Published
2021-06-28
Title
Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
bookster
Published
2024-06-05
Title
Bookster < 1.2.0 - Unauthenticated Appointment Status Update
Slug
bookster
Published
2026-02-17
Title
Bookster – WordPress Appointment Booking Plugin < 2.2.0 - Authenticated (Administrator+) SQL Injection via 'raw'
Slug
booktics
Published
2026-03-09
Title
Booktics < 1.0.17 - Unauthenticated Addons Installation
Slug
booktics
Published
2026-03-09
Title
Booktics < 1.0.17 - Unauthenticated Get Items via REST API endpoints
Slug
bookx
Published
2014-08-01
Title
BookX 1.7 - includes/bookx_export.php file Parameter Remote Path Traversal File Access
Slug
boom-fest
Published
2025-01-24
Title
Boom Fest < 2.2.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Slug
boombox-shortcode
Published
2024-11-08
Title
Boombox Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting