WP Booking System <= 1.5.1.1 - CSRF to Authenticated SQL Injection

According to the original researcher, no CSRF nonces were present and therefore could be exploited by chaining with the CSRF issue...

CVE-2019-12239

The CVE-2019-12239 entry concerns the WordPress WP Booking System plugin (version 1.5.1) with a lack of CSRF protection, which allows reaching SQL injection issues that require administrative access. Connected documents confirm this vulnerability and its remediation guidance, e.g., Patchstack and...

CVE-2019-12239: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access...

CVE-2017-2168

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2168

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2168

The CVE-2017-2168 entry maps to the WordPress plugin WP Booking System. A stored cross-site scripting (XSS) vulnerability exists in WP Booking System Free versions prior to 1.4 and Premium versions prior to 3.7, allowing remote attackers to inject arbitrary scripts via unspecified vectors. Impact...

CVE-2017-2168: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2017-15228

Name of the Vulnerable Software and Affected Versions WP Booking System Free versions prior to 1.4 WP Booking System Premium versions prior to 3.7 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For W...

WP Booking System <= 1.3.3 - Authenticated Stored Cross-Site Scripting (XSS)

The WP Booking System – Booking Calendar WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...