46 matches found
CVE-2026-14854
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...
CVE-2026-14854
The WooCommerce Bookings WordPress plugin, in versions prior to 3.11.0 , is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because the plugin fails to limit a user-supplied value used for memory allocation within an unauthenticated AJAX action . An unauthenticated atta...
CVE-2026-14854 WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...
EUVD-2026-96746
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...
CVE-2026-14854: Uncontrolled Resource Consumption
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...
CVE-2026-14853
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
EUVD-2026-64636
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
WordPress WooCommerce Bookings plugin < 3.9.0 - Subscriber+ Draft Bookable Product Creation vulnerability
Subscriber+ Draft Bookable Product Creation vulnerability discovered by Mike Gozdiskowski in WordPress Plugin WooCommerce Bookings versions 3.9.0...
CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
CVE-2026-14853
The WooCommerce Bookings WordPress plugin, in versions before 3.9.0 , is vulnerable to unauthorized action execution. The plugin fails to perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token. This allows users with Subscriber-level acces...
CVE-2026-14853: Missing Authorization
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
PT-2026-79760
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...
CVE-2026-12393
The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders...
EUVD-2026-37656
Subscriber Arbitrary File Download in Woocommerce Book Price = 1.3 versions...
PT-2026-50287
Subscriber Arbitrary File Download in Woocommerce Book Price = 1.3 versions...
CVE-2025-12788
CVE-2025-12788 concerns the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin. The vulnerability affects all versions up to 1.1.27 and stems from missing server-side verification of payment status inside the tfhb_meeting_paypal_payment_confirmation_callback function; the ...
EUVD-2023-51885
Malicious code in bioql PyPI...
CVE-2024-31117
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moises Heberle WooCommerce Bookings Calendar.This issue affects WooCommerce Bookings Calendar: from n/a through 1.0.36...