WP Hotel Booking <= 2.0.7 - SQL Injection

WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admininit, letting unauthenticated users perform SQL injections, exploit requires no authentication. id: CVE-2023-5652 info: name: WP...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: 一个预订时段到管理员XSS 我在WordPress WP Time Slots Booking Form插件中发现了一个未认证存储型XSS。公开的预订提交控制了存储时间段值的部分。插件随后在管理员预订订单页面输出该值时没有进行转义。 技巧很简单：插件按字面空格拆分提交的预约字符串，但HTML将制表符视为标签名和属性之间的空白。所以 8: 作为时段值通过了插件解析器，然后在管理员打开预订列表时变成了实际的标记。...

CVE-2026-9055

CVE-2026-9055 — Escalada de Privilegios No Autenticada en el Plugin Amelia Booking Informe de investigación de Sentinel AI Defense. Solo análisis defensivo — no se publica aquí ningún exploit funcional ni PoC para esta vulnerabilidad. Una vulnerabilidad de escalada de privilegios no autenticada e...

CVE-2024-3605

CVE-2024-3605 WP Hotel Booking = 2.1.0 - 未认证SQL注入 描述 WP Hotel Booking WordPress插件在所有版本（包括2.1.0）中，通过REST API端点/wphb/v1/rooms/search-rooms的'roomtype'参数存在SQL注入漏洞，原因是用户提供的参数未充分转义且现有SQL查询缺乏充分预处理。这使得未认证攻击者能够将额外的SQL查询附加到已有查询中，从而从数据库中提取敏感信息。 详情 类型 : 插件 Slug : wp-hotel-booking 受影响版本 : 2.1.0 CVSS评分 : 10...

CVE-2026-15398

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-18042

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

CVE-2026-18042 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation vulnerability

Unauthenticated Arbitrary Booking Cancellation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Travel versions 12.0.2...

CVE-2026-18042

WP Travel WordPress plugin versions before 12.0.2 fail to verify that the requester is authorized to act on the booking targeted by its front-end payment-message handlers. This missing authorization check allows unauthenticated attackers to cancel the payment on any customer's booking, resulting ...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Booking Payment State Tampering vulnerability

Unauthenticated Booking Payment State Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

CVE-2026-13146 WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

EUVD-2026-74698

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset vulnerability

Unauthenticated Arbitrary Booking Payment Reset vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

CVE-2023-29809

Título del exploit: Inyección SQL no autenticada Google Dork: Fecha: 27.04.2023 Autor del exploit: Lucas Noki 0xPrototype Página web del proveedor: https://github.com/vogtmh Enlace del software: https://github.com/vogtmh/cmaps Versión: 8.0 Probado en: Mac, Windows, Linux CVE : CVE-2023-29809...

CVE-2024-1207

Booking Calendar = 9.9 - 未经验证的SQL注入（CVE-2024-1207） https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent: Mozilla/5.0 Windows...

CVE-2026-49083

CVE-2026-49083 CVE-2026-49083 LatePoint日历预订插件权限提升漏洞利用 🎲🎲🎲...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...

CVE-2023-43147

CVE-2023-43147 Vendedor: PHPJabbers Página web del vendedor: https://www.phpjabbers.com/ Enlace del software: https://www.phpjabbers.com/limo-booking-software Versión: 1.0 Probado en: Windows 10 Pro Impacto: Agregar un usuario atacante con privilegios de administrador CVE: La vulnerabilidad de...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - Vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Descripción técnica: Existe una vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Un atacante puede aprovechar esta...