184 matches found
CVE-2026-14365: Missing Authorization
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
WordPress TrueBooker – Appointment Booking and Scheduler System plugin <= 1.2.2 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Karan J in WordPress Plugin TrueBooker versions = 1.2.2...
WordPress TrueBooker plugin < 1.2.4 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin TrueBooker versions 1.2.4...
CVE-2026-13161
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
CVE-2026-13161
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
CVE-2026-13161 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
EUVD-2026-49722
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
CVE-2026-13161 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
CVE-2026-13161
CVE-2026-13161 affects the WordPress plugin TrueBooker – Appointment Booking and Scheduler System up to version 1.2.2. The vulnerability is a generic SQL Injection via the parameter alldata[truebooker_user], caused by insufficient escaping and inadequate preparation of the underlying SQL query. I...
CVE-2026-14545
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-14545
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-14545 TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
EUVD-2026-49698
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-14545
The TrueBooker WordPress plugin versions before 1.2.4 is vulnerable to an unauthenticated account takeover due to a lack of account ownership validation during the password reset process. An unauthenticated attacker can exploit this flaw via one of the plugin's front-end account handlers to set a...
CVE-2026-14545 TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-13161: Improper Neutralization of Special Elements used in an SQL Command
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
PT-2026-65390
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
PT-2026-65413
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebooker user' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
CVE-2026-14545: Improper Privilege Management
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...