CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

WordPress MotoPress Appointment Booking plugin < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion vulnerability

Unauthenticated Arbitrary Reservation Deletion vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin MotoPress Appointment Booking versions 2.4.8...

EUVD-2025-13293

Malicious code in bioql PyPI...

CVE-2025-1326

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homeyreservationdel function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...