CVE-2026-27345

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

EUVD-2026-57931

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

CVE-2026-27345 WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

CVE-2026-27345

The CVE-2026-27345 entry concerns the WordPress plugin “Taxi Booking Manager for WooCommerce” (versions

PT-2026-71496

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Arif Shaikh in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 2.0.3...

EUVD-2026-54202

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-16067

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-16067

The CVE concerns the Event Booking Manager for WooCommerce (Pro) WordPress plugin, affected versions prior to 5.0.3. The vulnerability arises because the plugin does not validate the ticket price on the server during its native checkout, trusting the per-ticket price supplied by the client. As a ...

CVE-2026-16063

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

CVE-2026-16064

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

CVE-2026-16062 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

CVE-2026-16064 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...

EUVD-2026-51948

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

EUVD-2026-51949

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

CVE-2026-16063

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

CVE-2026-16063 Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary...

CVE-2026-16064

CVE-2026-16064 affects the Event Booking Manager for WooCommerce WordPress plugin (pre-5.3.7). The root cause is improper authorization on objects being modified during quick-edit actions, validating only a global capability. This permits users with Contributor role and above to alter the title a...

EUVD-2026-51950

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...