Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576)

This module exploits a Server Side Request Forgery SSRF vulnerability in Wordpress's Planyo Online Reservation System v3.0 or less. The plugin's AJAX proxy ulap.php does not require authentication and does not validate URL scheme supplied via ulapurl parameter. This allows unauthenticated attacke...

CVE-2025-31811

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through = 3.1...