CVE-2025-6058

CVE-2025-6058 affects the WPBookit WordPress plugin, vulnerable up to version 1.0.4 due to missing file type validation in the image_upload_handle function invoked via the add_booking_type route. Unauthenticated attackers can upload arbitrary files to the target server, with potential remote code...

CVE-2025-0357

The CVE-2025-0357 entry concerns the WordPress WPBookit plugin (versions up to 1.6.9). The underlying issue is insufficient file type validation in the function WPB_Profile_controller::handle_image_upload, permitting unauthenticated arbitrary file uploads on affected sites and potentially enablin...

CVE-2025-3810

CVE-2025-3810 (WPBookit, WordPress) is an unauthenticated privilege-escalation vulnerability caused by improper validation in the edit_profile_data() path, enabling attackers to modify any user’s email or password (including admins) and take over accounts. Connected sources confirm the issue affe...

CVE-2025-3811

CVE-2025-3811 (WPBookit) affects the WordPress plugin WPBookit in all versions up to 1.0.2. The issue is an authentication/identity validation flaw in edit_newdata_customer_callback() that allows an unauthenticated attacker to change arbitrary users’ emails (including administrators), enabling pa...

CVE-2024-10215

The CVE-2024-10215 entry concerns the WPBookit WordPress plugin (versions up to and including 1.6.4). The root cause is that the plugin exposes user-controlled access to objects, allowing unauthorized users to bypass authorization and change passwords. The practical impact is that unauthenticated...

CVE-2025-26910

CVE-2025-26910: WordPress WPBookit <= 1.0.1 contains a CSRF vulnerability that enables stored XSS. Affected software: WPBookit plugin (WPBookit <= 1.0.1). Remediation: patch status shows mitigation/patch applied (patched for WPBookit

CVE-2025-32254

Technical details (affected version, exploit, impact, remediation) for CVE-2025-32254 are not provided in the supplied documents; no public details are included here.

CVE-2024-54280

CVE-2024-54280 is an Unauthenticated SQL Injection affecting WPBookit (Iqonic Design) for WordPress, with affected versions from n/a up to 1.6.0. The vulnerability is due to improper neutralization of special elements in SQL queries. The connected Red Hat entry reiterates the same CVE and descrip...

CVE-2025-6057

CVE-2025-6057 affects the WordPress plugin WPBookit, with all versions up to and including 1.0.4. The root cause is missing file type validation in handle_image_upload(), enabling authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server, potentially e...