EUVD-2026-101849

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

CVE-2026-107425

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

WordPress WP Booking System plugin < 2.1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Eric Buntain in WordPress Plugin WP Booking System versions 2.1.0.1...

CVE-2026-107425

The Bus Ticket Booking with Seat Reservation plugin by Magepeople inc. (versions up to 5.9.7 ) is vulnerable to a Broken Access Control issue. The root cause is a Missing Authorization (CWE-862) vulnerability, specifically allowing the exploitation of incorrectly configured access control securit...

CVE-2026-107425 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

EUVD-2026-101016

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

CVE-2026-103366

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-103380

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 5.7.3 . The root cause is a template re-expansion flaw involving the params[customer][first_name] parameter. Authenticated attackers wit...

CVE-2026-103366

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.3 . The vulnerability exists because the OsStepsHelper::set_required_objects() function passes raw request parameters to...

CVE-2026-100163 Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::createwpuserforcustomer helper reached from the public processstepcustomer booking step...

EUVD-2026-100901

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-103366 Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-100163

The LatePoint | Calendar & Scheduling for WordPress plugin is vulnerable to an Authentication Bypass in versions up to and including 5.7.2 . The flaw exists in the OsCustomerHelper::create_wp_user_for_customer() helper, which is triggered during the public process_step_customer() booking step. Wh...

CVE-2026-107126

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

CVE-2026-107126 WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

CVE-2026-107126

The WP Booking System WordPress plugin (versions before 2.1.0.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize and escape a client-controllable request value before storing it. This stored value is subsequently outputted in an administr...

EUVD-2026-100886

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the sessi...

CVE-2026-103425

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-103423

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally...

CVE-2026-103425 Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...