CVE-2026-14853

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853

The WooCommerce Bookings WordPress plugin, in versions before 3.9.0 , is vulnerable to unauthorized action execution. The plugin fails to perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token. This allows users with Subscriber-level acces...

WordPress WooCommerce Bookings plugin < 3.9.0 - Subscriber+ Draft Bookable Product Creation vulnerability

Subscriber+ Draft Bookable Product Creation vulnerability discovered by Mike Gozdiskowski in WordPress Plugin WooCommerce Bookings versions 3.9.0...

CVE-2026-14853: Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

PT-2026-79760

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-12393

The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders...

EUVD-2026-37656

Subscriber Arbitrary File Download in Woocommerce Book Price = 1.3 versions...

PT-2026-50287

Subscriber Arbitrary File Download in Woocommerce Book Price = 1.3 versions...

CVE-2025-12788

CVE-2025-12788 concerns the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin. The vulnerability affects all versions up to 1.1.27 and stems from missing server-side verification of payment status inside the tfhb_meeting_paypal_payment_confirmation_callback function; the ...

EUVD-2023-51885

Malicious code in bioql PyPI...

CVE-2024-31117

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moises Heberle WooCommerce Bookings Calendar.This issue affects WooCommerce Bookings Calendar: from n/a through 1.0.36...

CVE-2023-47787

Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3...

CVE-2023-32747

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78...

WooCommerce Bookings Calendar <= 1.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WooCommerce Bookings Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access an...

CVE-2024-31117

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moises Heberle WooCommerce Bookings Calendar.This issue affects WooCommerce Bookings Calendar: from n/a through 1.0.36...

CVE-2024-31117

CVE-2024-31117 is an HTML/JavaScript input handling vulnerability (Cross-site Scripting) in the WordPress plugin WooCommerce Bookings Calendar by Moises Heberle. The description (from Red Hat and the CVE entry) states this is an improper neutralization of input during web page generation, enablin...

CVE-2024-31117 WordPress WooCommerce Bookings Calendar plugin <= 1.0.36 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moises Heberle WooCommerce Bookings Calendar.This issue affects WooCommerce Bookings Calendar: from n/a through 1.0.36...