CVE-2026-108758 Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...

EUVD-2026-96923

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...

CVE-2026-108758 Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...

CVE-2026-108758

Easy!Appointments versions through 1.6.0 are vulnerable to an authorization bypass within the Booking::register() function. This flaw allows unauthenticated attackers to modify any appointment by providing an appointment ID without the required hash. By enumerating sequential IDs and self-asserti...

CVE-2026-108758: Authorization Bypass Through User-Controlled Key

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...

CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-96276

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-96662 Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to unauthenticated SQL Injection in all versions up to and including 5.7.2 . The root cause is insufficient escaping on the booking[service_id] parameter combined with a lack of sufficient preparation o...

CVE-2026-95684

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-107712

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-107712

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.1.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the user-supplied 'current_month' parameter. This is a regression...

CVE-2026-107712 WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-96215

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-95684

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.15 . The flaw resides in the 'attachments[name]' parameter due to insufficient input sanitization and output escaping . This allows unauthentic...

EUVD-2026-96223

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-95684 VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-18496

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbcisshowpopoverinflextimeline function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses,...

CVE-2026-105995

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

CVE-2026-105995

The Booking Package WordPress plugin, in versions before 1.7.30 , is vulnerable to an information disclosure flaw. The plugin fails to perform necessary authorization checks before returning stored reservation data. This allows unauthenticated users to access and disclose sensitive information, i...