Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

Exploit Title: PlanyoOnlineReservationSystem 3.0 - Arbitrary File Read via SSRF Date: 12-07-2026 Exploit Author: Balachandar Gowrisankar Vendor Homepage: https://www.planyo.com/wordpress-reservation-system/ Software Link: https://plugins.svn.wordpress.org/planyo-online-reservation-system/tags/2.9...

CVE-2026-3576: Improper Input Validation

The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authenticatio...

CVE-2025-31811

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through = 3.1...

CVE-2025-31811 WordPress Planyo online reservation system plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtreeme Planyo online reservation system allows Stored XSS. This issue affects Planyo online reservation system: from n/a through 3.0...

CVE-2025-31811

CVE-2025-31811 describes a Stored Cross-Site Scripting vulnerability in the Planyo online reservation system (Planyo) WordPress plugin up to version 3.0. The issue arises from improper neutralization of input during web page generation, allowing stored XSS. Affected product: Planyo online reserva...