PT-2024-16626 · WordPress · Wp Booking Calendar

Name of the Vulnerable Software and Affected Versions: WP Booking Calendar versions prior to 10.6.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in multisite...

WordPress FAT Services Booking plugin <= 5.6 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Dave Jong Patchstack in WordPress Plugin FAT Services Booking versions = 5.6...

WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability

Subscriber+ Site-Wide Cross Site Scripting XSS vulnerability discovered by Dave Jong Patchstack in WordPress Plugin FAT Services Booking versions = 5.6...

CVE-2024-53762

Cross-Site Request Forgery CSRF vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This issue affects FastBook: from n/a through = 1.1...

CVE-2024-53753

CVE-2024-53753 is a vulnerability in the CultBooking Hotel Booking Engine (WordPress plugin) affecting versions

CVE-2024-53753 WordPress CultBooking Hotel Booking Engine plugin <= 2.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in CultBooking CultBooking Hotel Booking Engine cultbooking-booking-engine allows Stored XSS.This issue affects CultBooking Hotel Booking Engine: from n/a through = 2.1...

CVE-2024-53753 WordPress CultBooking Hotel Booking Engine plugin <= 2.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in CultBooking CultBooking Hotel Booking Engine allows Stored XSS.This issue affects CultBooking Hotel Booking Engine: from n/a through 2.1...

CVE-2024-53762

CVE-2024-53762 is a CSRF to Stored XSS vulnerability affecting the WordPress plugin FastBook – Responsive Appointment Booking and Scheduling System (FastBook) versions up to 1.1. The CVSS 3.1 base score is 7.1 (HIGH) with network attack vector, low attack complexity, no privileges required, but u...

WordPress Pinpoint Booking System plugin <= 2.9.9.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin Pinpoint Booking System versions = 2.9.9.5.1...

WordPress plugin CultBooking Hotel Booking Engine 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

How Is API Abuse Different from Web Application Attacks by Bots?

API abuse and web application bot attacks are often confused. This is understandable, as both involve automated interactions and are usually executed by bots. Both attack vectors are prevalent; criminals are always eager to disrupt the foundations on which businesses base their operations to...

WordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by thiennv in WordPress Plugin Awesome Event Booking versions = 2.7.1...

CVE-2024-9504 Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-9504

CVE-2024-9504 affects the Booking calendar, Appointment Booking System plugin for WordPress, with an unauthenticated stored XSS via SVG uploads in versions up to 3.2.15 caused by inadequate input sanitization and output escaping. The vulnerability permits injection of script code that executes wh...

CVE-2024-10729

CVE-2024-10729 affects Booking & Appointment Plugin for WooCommerce for WordPress (versions up to and including 6.9.0). Root cause: missing capability check in the save_google_calendar_data function, allowing authenticated users with subscriber-level permissions or higher to arbitrarily update si...

WordPress Beds24 Online Booking plugin <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via beds24-link Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Beds24 Online Booking versions = 2.0.27...

PT-2024-16491 · Woocommerce · Booking & Appointment Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booking & Appointment Plugin for WooCommerce version 6.9.0 and earlier Description: The issue is related to a missing capability check in the save google calendar data function, allowing authenticated attackers with subscriber-level permissio...

WordPress Beds24 Online Booking Plugin <= 2.0.26 is vulnerable to Cross Site Scripting (XSS)

Software Beds24 Online Booking Type Plugin Vulnerable versions = 2.0.26 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10177 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ca546aa081c0 Credits Peter Thaleikis...

WordPress plugin Booking & Appointment Plugin for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-39665 · WordPress · Booking Calendar

Name of the Vulnerable Software and Affected Versions: The Booking calendar, Appointment Booking System plugin for WordPress versions up to, and including, 3.2.15 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and outpu...