TrueBooker <= 1.0.2 - SQL Injection

The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

WordPress MotoPress Appointment Booking plugin < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion vulnerability

Unauthenticated Arbitrary Reservation Deletion vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin MotoPress Appointment Booking versions 2.4.8...

EUVD-2026-69868

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

CVE-2025-7753

🚨 CVE-2025-7753 — SQL 注入 PoC 利用工具 作者: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 漏洞类型: 未认证的基于时间的 SQL 注入 🔍 概述 在 在线预约系统 1.0 （Code‑Projects）中的 /admin/adddoctor.php 文件存在一个严重的 SQL 注入漏洞。username 参数未正确过滤，允许远程攻击者执行任意 SQL 查询（基于时间、基于错误、联合查询、布尔盲注）。 本仓库提供了 首个公开的 PoC ，使用 C 语言编写，利用 libcurl 进行 HTTP...

CVE-2026-9830

-orange?style=for-the-badge CVE-2026-9830 — Omisión de Autenticación en BookingPress Pro Investigación Integral de Inteligencia de Amenazas Cibernéticas Resumen • Informes • Hallazgos Clave • Detalles Técnicos • Evaluación de Riesgo • Mitigación • Referencias 📋 Resumen CVE-2026-9830 es una...

CVE-2025-46181-XSS

CVE-2025-46181 - XSS Riflesso in un Sistema di Prenotazione Appuntamenti Online CVE-ID : CVE-2025-46181 Scoperto da : Shemkumar P shemkumar.github.io Tipo di Vulnerabilità : Cross-Site Scripting Riflesso XSS Gravità : Media Stato : Divulgato, CVE Assegnato da MITRE ✨ Descrizione Esiste una...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

EUVD-2026-68053

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

CVE-2026-68566

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

EUVD-2026-63309

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-68566 WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-14334 Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin (versions up to 3.2.36) fails to sanitize uploaded SVG files, allowing unauthenticated attackers to inject JavaScript that executes in an administrator's session when reviewing a submitted booking. CVSS 3.1 base score is 8.8 (HIGH)...

EUVD-2026-62264

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

PT-2026-78278

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System WordPress plugin versions prior to 3.2.37 Description The plugin fails to properly sanitize uploaded SVG files. This allows unauthenticated attackers to upload a file that bypasses the...

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...