2994 matches found
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
Easy!Appointments correctly filters provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and appointments/update only check generic appointment privileges and...
CVE-2026-13161: Improper Neutralization of Special Elements used in an SQL Command
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
Malicious Package
Overview hubert-appointment-v2-task-create-am is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...
WordPress BookingPress Appointment Booking Pro 5.7.2 Authentication Bypass
WordPress BookingPress Appointment Booking Pro plugin version 5.7.2 contains an authentication bypass vulnerability in its REST API that may allow an unauthenticated attacker to bypass authentication and gain unauthorized access. The repository contains technical analysis, threat intelligence...
CVE-2026-9830: Improper Authentication
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...
@aaravpos/appointment-barber-booking (>=1.0.0, <=5.0.0), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.9) +247 more potentially affected by CVE-2026-53667 via react-router (>=7.11.0, <=7.17.0)
react-router NPM version =7.11.0, =1.0.0, =1.0.1, =0.0.9-alpha-20251217170854-13a5505369f22d85f29bcbbbe455c23672e2aca3, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...
CVE-2026-65514
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
CVE-2026-27377
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress = 1.0.16 versions...
CVE-2026-65514 WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
EUVD-2026-48119
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
CVE-2026-65514
CVE-2026-65514 affects the WordPress plugin Appointment Hour Booking up to version 1.5.86, with a reported Cross Site Scripting (XSS) vulnerability. The CVSS 3.1 base score is 6.5 (Medium); attack vector is network, attack complexity low, privileges required low, and user interaction is required,...
CVE-2026-65514 WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
CVE-2026-65514
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
EUVD-2026-48154
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress = 1.0.16 versions...
CVE-2026-27377
CVE-2026-27377 affects the WordPress plugin QuickCal – Appointment Booking Calendar for WordPress (versions
CVE-2026-27377 WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress = 1.0.16 versions...
CVE-2026-27377 WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress = 1.0.16 versions...
WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Appointment Hour Booking versions = 1.5.86...
