CVE-2026-91024

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2026-91077

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-91025

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.7.2 - Contributor+ Unpublished Event Disclosure vulnerability

Contributor+ Unpublished Event Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.3.6-5.7.2...

EUVD-2026-85059

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-91077

The Event Booking Manager for WooCommerce WordPress plugin (versions 5.3.6 - 5.7.2 ) is vulnerable to an Improper Access Control issue. The plugin fails to restrict its event listing query, allowing users with contributor-level access and above to retrieve private, draft, and trashed events belon...

CVE-2026-91077 Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

EUVD-2026-85056

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2026-91024

The Booking Manager WordPress plugin (versions before 2.1.21 ) is vulnerable to SQL injection due to improper neutralization of special elements. The root cause is the failure to sanitize and escape values retrieved from a fetched external iCalendar feed before incorporating them into a SQL query...

CVE-2026-91025

The Booking Manager WordPress plugin, in versions prior to 2.1.21 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify that requests to modify per-user settings target the requesting user's own account. This flaw allows any authenticated user with subscribe...

CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

EUVD-2026-85057

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

WordPress Booking Manager plugin < 2.1.21 - Author+ SQLi vulnerability

Author+ SQLi vulnerability discovered by Mohamed Bassia in WordPress Plugin Booking Manager versions 2.1.21...

WordPress Booking Manager plugin < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification vulnerability

Subscriber+ Arbitrary User Plugin Meta Modification vulnerability discovered by Choriyev Qahramon ciprobe in WordPress Plugin Booking Manager versions 2.1.21...

CVE-2026-93928

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8...

CVE-2026-93928

CVE-2026-93928 is an Authentication Bypass Using an Alternate Path or Channel vulnerability in the Taxi Booking Manager for WooCommerce plugin by Magepeople Inc. , affecting versions before 2.0.8 . The vulnerability allows unauthenticated, network-based attackers to bypass authentication with low...

CVE-2026-93928: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8...

WordPress Event Booking Manager for WooCommerce (Pro) plugin <= 5.0.2 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Event Booking Manager for WooCommerce Pro versions = 5.0.2...

CVE-2026-91019

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...