WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-08-28
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.7.7 - Missing Authorization
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-08-25
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.7.6 - Authenticated (Contributor+) PHP Object Injection
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-09-03
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-10-26
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.8.3 - Missing Authorization
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-10-15
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.8.1 - Unauthenticated Reduced Booking Price
Slug
booking-and-rental-manager-for-woocommerce
Published
2026-10-30
Title
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment < 2.8.3 - Missing Authorization
Slug
booking-calendar
Published
2018-01-12
Title
Booking Calendar <= 2.1.7 - Authenticated Stored XSS & CSRF
Slug
booking-calendar
Published
2018-06-07
Title
Booking Calendar < 2.2.3 - Parameters Tampering Allowing Arbitrary Prices Change
Slug
booking-calendar
Published
2022-11-21
Title
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
Slug
booking-calendar
Published
2023-01-27
Title
Booking calendar, Appointment Booking System < 3.2.4 - Form Creation/Update/Deletion/Duplication via CSRF
Slug
booking-calendar
Published
2023-01-27
Title
Booking calendar, Appointment Booking System < 3.2.4 - Editor+ Stored XSS
Slug
booking-calendar
Published
2023-04-19
Title
Booking calendar, Appointment Booking System < 3.2.8 - Admin+ SQLi
Slug
booking-calendar
Published
2023-09-12
Title
Booking calendar, Appointment Booking System < 3.2.9 - Multiple Authenticated(Editor+) SQL Injection
Slug
booking-calendar
Published
2023-10-29
Title
Booking Calendar WpDevArt < 3.2.12 - Admin+ SQLi
Slug
booking-calendar
Published
2024-11-25
Title
Booking calendar, Appointment Booking System < 3.2.16 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Slug
booking-calendar
Published
2025-01-06
Title
Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
Slug
booking-calendar
Published
2024-12-23
Title
Booking Calendar WpDevArt < 3.2.20 - Authenticated (Contributor+) SQL Injection
Slug
booking-calendar
Published
2025-07-01
Title
Booking calendar, Appointment Booking System < 3.2.18 - Unauthenticated Time-Based SQLi
Slug
booking-calendar
Published
2025-12-15
Title
Booking calendar, Appointment Booking System < 3.2.31 - Missing Authorization
Slug
booking-calendar
Published
2026-03-18
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
Slug
booking-calendar
Published
2026-07-02
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization
Slug
booking-calendar
Published
2026-08-14
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
Slug
booking-calendar
Published
2026-08-18
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Insecure Direct Object Reference
Slug
booking-calendar
Published
2026-08-17
Title
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
Slug
booking-calendar-and-notification
Published
2025-02-28
Title
Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions