7467 matches found
WP BASE Booking - Reflected XSS
WP BASE Booking of Appointments, Services and Events WordPress plugin 5.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to...
WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting
WordPress Advanced Booking Calendar plugin before 1.7.1 contains a cross-site scripting vulnerability. It does not sanitize and escape the room parameter before outputting it back in an admin page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of th...
Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting
Sourcecodester Online Event Booking and Reservation System 2.3.0 contains a cross-site scripting vulnerability in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clic...
ND Booking < 2.5 - Unauthenticated Options Change
The Hotel Booking WordPress plugin ND Booking 2.5 was affected by an Unauthenticated Options Change security vulnerability. id: CVE-2019-15774 info: name: ND Booking 2.5 - Unauthenticated Options Change author: popcorn94 severity: medium description: | The Hotel Booking WordPress plugin ND Bookin...
TrueBooker <= 1.0.2 - SQL Injection
The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server id: CVE-2023-5991 info: name: Hotel Booking...
CVE-2026-59558
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
CVE-2026-59548
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...
CVE-2026-59532
Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...
CVE-2026-59558
The CVE-2026-59558 entry documents an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Booking Calendar plugin, affected versions <= 11.4.2. The issue concerns the Booking Calendar component/functionality and is characterized by unauthenticated XSS, allowing an attacke...
CVE-2026-59558
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
EUVD-2026-49225
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
CVE-2026-59558 WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
CVE-2026-59548 WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...
EUVD-2026-49217
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...
CVE-2026-59548
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...
CVE-2026-59548
The CVE concerns WordPress Byteflows Travel & Hotel Booking plugin, version