7887 matches found
WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability
WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...
CVE-2026-73363
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-73363
CVE-2026-73363 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin Taxi Booking Manager for WooCommerce (plugin slug: ecab-taxi-booking-manager ), affecting versions prior to 2.0.8 . The flaw allows a low-privileged user to perform unauthorized actions, resulting in ...
EUVD-2026-62383
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-14334
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...
CVE-2026-14334 Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...
CVE-2026-14334
The Booking calendar, Appointment Booking System WordPress plugin (versions up to 3.2.36) fails to sanitize uploaded SVG files, allowing unauthenticated attackers to inject JavaScript that executes in an administrator's session when reviewing a submitted booking. CVSS 3.1 base score is 8.8 (HIGH)...
EUVD-2026-62264
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...
PT-2026-78278
Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System WordPress plugin versions prior to 3.2.37 Description The plugin fails to properly sanitize uploaded SVG files. This allows unauthenticated attackers to upload a file that bypasses the...
WordPress WP Travel Engine plugin < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart vulnerability
Unauthenticated Booking Details Disclosure and Modification via wteaddtriptocart vulnerability discovered by Usama Arshad in WordPress Plugin WP Travel Engine versions 6.8.5...
CVE-2026-73395
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-66679
Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...
CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
EUVD-2026-60801
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395
The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....
CVE-2026-73395
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-66679 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...