EUVD-2026-76803

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87894

CVE-2026-87894 affects the Rox Appointment Booking WordPress plugin, versions 1.0.9 through 1.2.2 . The vulnerability is an unauthenticated IDOR (Insecure Direct Object Reference) on the endpoint that returns a booking's confirmation details. Because the plugin performs no authorization check and...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin versions before 1.2.0 fail to verify the order total or the selected payment method against server-side pricing when creating a booking. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass the site's conf...

EUVD-2026-76804

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin, versions before 1.2.0 , lacks a capability or authorization check when saving its holiday schedule via the REST API. This allows unauthenticated attackers to overwrite the dates the booking system treats as unavailable, potentially blocking legitimate...

EUVD-2026-76802

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

TrueBooker <= 1.0.2 - SQL Injection

The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-9830

-orange?style=for-the-badge CVE-2026-9830 — Omisión de Autenticación en BookingPress Pro Investigación Integral de Inteligencia de Amenazas Cibernéticas Resumen • Informes • Hallazgos Clave • Detalles Técnicos • Evaluación de Riesgo • Mitigación • Referencias 📋 Resumen CVE-2026-9830 es una...

CVE-2025-7753

🚨 CVE-2025-7753 — SQL 注入 PoC 利用工具 作者: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 漏洞类型: 未认证的基于时间的 SQL 注入 🔍 概述 在 在线预约系统 1.0 （Code‑Projects）中的 /admin/adddoctor.php 文件存在一个严重的 SQL 注入漏洞。username 参数未正确过滤，允许远程攻击者执行任意 SQL 查询（基于时间、基于错误、联合查询、布尔盲注）。 本仓库提供了 首个公开的 PoC ，使用 C 语言编写，利用 libcurl 进行 HTTP...

CVE-2025-46181-XSS

CVE-2025-46181 - XSS reflejado en un sistema de reserva de citas en línea CVE-ID : CVE-2025-46181 Descubierto por : Shemkumar P shemkumar.github.io Tipo de vulnerabilidad : Cross-Site Scripting XSS reflejado Severidad : Media Estado : Divulgado, CVE asignado por MITRE ✨ Descripción Existe una...

CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

EUVD-2026-69868

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

WordPress MotoPress Appointment Booking plugin < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion vulnerability

Unauthenticated Arbitrary Reservation Deletion vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin MotoPress Appointment Booking versions 2.4.8...

CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

EUVD-2026-68053

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

CVE-2026-68566

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

EUVD-2026-63309

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-68566 WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...