CVE-2026-9830

-orange?style=for-the-badge CVE-2026-9830 — BookingPress Pro Authentication Bypass Comprehensive Cybersecurity Threat Intelligence Investigation Overview • Reports • Key Findings • Technical Details • Risk Assessment • Mitigation • References 📋 Overview CVE-2026-9830 is a critical authentication...

TrueBooker <= 1.0.2 - SQL Injection

The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2025-46181-XSS

CVE-2025-46181 - XSS Riflesso in un Sistema di Prenotazione Appuntamenti Online CVE-ID : CVE-2025-46181 Scoperto da : Shemkumar P shemkumar.github.io Tipo di Vulnerabilità : Cross-Site Scripting Riflesso XSS Gravità : Media Stato : Divulgato, CVE Assegnato da MITRE ✨ Descrizione Esiste una...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

EUVD-2026-68053

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

CVE-2025-7753

🚨 CVE-2025-7753 — Exploit PoC di SQL Injection Autore: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 Vulnerabilità: SQL Injection non autenticata, basata sul tempo 🔍 Panoramica Una vulnerabilità critica di SQL Injection esiste in Online Appointment Booking System 1.0 Code‑Projects nel fil...

CVE-2026-68566

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

EUVD-2026-63309

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-68566 WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in BookingPress Appointment Booking Pro = 6.0.2 versions...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-14334 Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin (versions up to 3.2.36) fails to sanitize uploaded SVG files, allowing unauthenticated attackers to inject JavaScript that executes in an administrator's session when reviewing a submitted booking. CVSS 3.1 base score is 8.8 (HIGH)...

EUVD-2026-62264

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

PT-2026-78278

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System WordPress plugin versions prior to 3.2.37 Description The plugin fails to properly sanitize uploaded SVG files. This allows unauthenticated attackers to upload a file that bypasses the...

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395

The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....

EUVD-2026-60801

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-8840

The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...