CVE-2022-1463

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the bookingflextimeline shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site...

PT-2022-13906

Name of the Vulnerable Software and Affected Versions Booking Calendar plugin for WordPress version 9.1 and earlier Description The issue allows for PHP Object Injection via the bookingflextimeline shortcode. This could be exploited by subscriber-level users and above to call arbitrary PHP object...

CVE-2022-1463: Deserialization of Untrusted Data

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the bookingflextimeline shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site...