CVE-2025-4669 Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4669

CVE-2025-4669 affects WP Booking Calendar (WordPress) up to and including version 10.11.1, due to insufficient input sanitization and output escaping on the wpbc shortcode attributes. The issue enables stored XSS for authenticated users with contributor-level access and above, potentially executi...

WordPress plugin WP Booking Calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-21789 · WordPress · Wp Booking Calendar

Name of the Vulnerable Software and Affected Versions: WP Booking Calendar plugin for WordPress versions up to, and including, 10.11.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wpbc shortcode due to insufficient input sanitization and output escaping on...

WordPress Booking Calendar plugin <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpbc Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Booking Calendar versions = 10.11.1...

CVE-2025-47693

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in roninwp FAT Services Booking fat-services-booking allows PHP Local File Inclusion.This issue affects FAT Services Booking: from n/a through = 5.5...

CVE-2025-32295

Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through = 10.10.2...

CVE-2025-32295 WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in wordpresschef Salon Booking Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Salon Booking Pro: from n/a through 10.10.2...

CVE-2025-32295 WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through = 10.10.2...

CVE-2025-32295

CVE-2025-32295 corresponds to a Missing Authorization (broken access control) vulnerability in the WordPress plugin Salon Booking Pro (WordPress Salon Booking Pro) affecting version 10.10.2 and earlier. Multiple connected sources confirm an improper access-control configuration that could be expl...

CVE-2025-47693 WordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in roninwp FAT Services Booking allows PHP Local File Inclusion. This issue affects FAT Services Booking: from n/a through 5.5...

CVE-2025-47693 WordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in roninwp FAT Services Booking fat-services-booking allows PHP Local File Inclusion.This issue affects FAT Services Booking: from n/a through = 5.5...

CVE-2025-47693

CVE-2025-47693 affects the WordPress plugin FAT Services Booking (versions n/a through 5.5). The vulnerability is an improper control of the filename in PHP Include/Require statements, enabling PHP Local File Inclusion (LFI). Connected sources indicate this is a local-file-inclusion issue often d...

WordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin FAT Services Booking versions = 5.5...

WordPress plugin FAT Services Booking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-21714 · Roninwp · Roninwp Fat Services Booking

Name of the Vulnerable Software and Affected Versions: roninwp FAT Services Booking versions n/a through 5.5 Description: The issue affects the roninwp FAT Services Booking, allowing for PHP Local File Inclusion due to an Improper Control of Filename for Include/Require Statement in PHP Program...

PT-2025-21688 · Unknown · Salon Booking Pro

Name of the Vulnerable Software and Affected Versions: Salon Booking Pro versions 10.10.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 10.10.2 an...

WordPress plugin Salon Booking Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-9882

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...

CVE-2024-9882

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...