CVE-2026-97248

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

CVE-2026-97079

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

CVE-2026-97248

The Booking Activities WordPress plugin in versions

CVE-2026-97248 WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

EUVD-2026-89912

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

CVE-2026-97248 WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

CVE-2026-97079

The Webba Booking WordPress plugin (versions

CVE-2026-97079 WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

CVE-2026-97079 WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

EUVD-2026-89897

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

CVE-2026-96886

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2026-96886

The Course Booking System WordPress plugin, in versions prior to 7.0.9 , contains a vulnerability where it fails to restrict access to its booking export function. This allows unauthenticated users to download sensitive personally identifiable information (PII), including the name, email address,...

CVE-2026-96886 Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

EUVD-2026-89626

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

Malicious code in booking-eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The...

Malicious code in booking-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08305a6c73bd94f2983c949316cb78fef7f7169f85523a773c94fb305874e063 The package's package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The bundled 4444.vbs contains...

Online Event Booking and Reservation System 2.3.0 - SQL Injection

Online Event Booking and Reservation System 2.3.0 contains a SQL injection vulnerability in event-management/views. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

WP BASE Booking - Reflected XSS

WP BASE Booking of Appointments, Services and Events WordPress plugin 5.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to...

WordPress Booking Calendar <3.2.2 - Arbitrary File Upload

WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify...