CVE-2025-23955

CVE-2025-23955 affects the Xola WordPress plugin (Xola: Booking for WordPress and Tours) up to version 1.6. It is described as a Missing Authorization vulnerability with broken access control, enabling unauthorized access to certain resources. The CVSS 3.1 vector from Patchstack indicates: AV:N, ...

WordPress Xola plugin <= 1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Xola versions = 1.6...