WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
booking-package
Published
2022-03-09
Title
Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
Slug
booking-package
Published
2023-08-07
Title
Booking Package < 1.6.02 - Reflected XSS
Slug
booking-package
Published
2024-03-28
Title
Booking Package < 1.6.29 - Unauthenticated Price Manipulation
Slug
booking-package
Published
2025-02-18
Title
Booking Package < 1.6.73 - Reflected Cross-Site Scripting via Locale Parameter
Slug
booking-package
Published
2026-04-21
Title
Booking Package < 1.7.07 - Missing Authorization
Slug
booking-package
Published
2026-04-27
Title
Booking Package < 1.7.07 - Unauthenticated Price Manipulation via 'amount' Parameter
Slug
booking-package
Published
2026-06-05
Title
Booking Package < 1.7.17 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action
Slug
booking-package
Published
2026-07-10
Title
Booking Package < 1.7.21 - Unauthenticated SQL Injection via 'email' Form Parameter
Slug
booking-package
Published
2026-08-24
Title
Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters
Slug
booking-package
Published
2026-10-08
Title
Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure
Slug
booking-package
Published
2026-10-13
Title
Booking Package < 1.7.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Slug
booking-package
Published
2026-10-13
Title
Booking Package < 1.7.30 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
Slug
booking-package
Published
2026-10-19
Title
Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
Slug
booking-package
Published
2026-10-19
Title
Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure
Slug
booking-package
Published
2026-10-19
Title
Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token
Slug
booking-package
Published
2026-10-26
Title
Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
Slug
booking-sms
Published
2017-12-14
Title
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Slug
booking-system
Published
2014-08-01
Title
Booking System - Reflected Cross-Site Scripting (XSS)
Slug
booking-system
Published
2014-08-01
Title
Booking System <= 1.2 - SQL Injection
Slug
booking-system
Published
2015-07-07
Title
Pinpoint Booking System <= 2.0 - Authenticated Blind SQL Injection
Slug
booking-system
Published
2023-01-23
Title
Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi
Slug
booking-system
Published
2023-02-02
Title
Pinpoint Booking System < 2.9.9.2.9 - Admin+ Stored XSS
Slug
booking-system
Published
2023-10-13
Title
Pinpoint Booking System < 2.9.9.4.1 - Arbitrary Settings Update via CSRF
Slug
booking-system
Published
2024-07-15
Title
Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS
Slug
booking-system
Published
2024-09-06
Title
Pinpoint Booking System < 2.9.9.5.1- Authenticated (Subscriber+) SQL Injection