2337 matches found
EUVD-2026-80220
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...
CVE-2026-87907
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
CVE-2026-87896
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
CVE-2026-87896 Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
CVE-2026-87896
The Rox Appointment Booking WordPress plugin versions below 1.2.8 are affected by an unauthenticated PII disclosure vulnerability in its REST endpoint for booking agent (staff) records. The root cause is a missing authorization check on that endpoint, allowing any unauthenticated attacker to read...
EUVD-2026-80210
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
WordPress Rox Appointment Booking plugin < 1.2.8 - Unauthenticated Internal Notes Disclosure vulnerability
Unauthenticated Internal Notes Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.8...
EUVD-2026-80211
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
CVE-2026-87907
The Rox Appointment Booking WordPress plugin (versions
WordPress Rox Appointment Booking plugin < 1.2.8 - Unauthenticated Staff PII Disclosure vulnerability
Unauthenticated Staff PII Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.8...
WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Holiday Schedule Modification vulnerability
Unauthenticated Holiday Schedule Modification vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...
WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability
Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability discovered by Morato Antoine in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...
WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.1 - Unauthenticated Appointment PII Disclosure vulnerability
Unauthenticated Appointment PII Disclosure vulnerability discovered by Philipp Doblhofer in WordPress Plugin BookIt versions 2.6.0.1...
CVE-2026-88995
CVE-2026-88995 affects the Bookit — Booking & Appointment Calendar WordPress plugin in versions before 2.6.0.1 . The root cause is that the plugin's availability-check request does not properly restrict the data it returns, allowing unauthenticated users to retrieve other customers' appointment d...
CVE-2026-87891
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...
CVE-2026-87892
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
CVE-2026-87894
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...
EUVD-2026-76803
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...