CVE-2025-6058

CVE-2025-6058 affects the WPBookit WordPress plugin, vulnerable up to version 1.0.4 due to missing file type validation in the image_upload_handle function invoked via the add_booking_type route. Unauthenticated attackers can upload arbitrary files to the target server, with potential remote code...

CVE-2025-0357

The CVE-2025-0357 entry concerns the WordPress WPBookit plugin (versions up to 1.6.9). The underlying issue is insufficient file type validation in the function WPB_Profile_controller::handle_image_upload, permitting unauthenticated arbitrary file uploads on affected sites and potentially enablin...

CVE-2025-3810

CVE-2025-3810 (WPBookit, WordPress) is an unauthenticated privilege-escalation vulnerability caused by improper validation in the edit_profile_data() path, enabling attackers to modify any user’s email or password (including admins) and take over accounts. Connected sources confirm the issue affe...

CVE-2025-3811

CVE-2025-3811 (WPBookit) affects the WordPress plugin WPBookit in all versions up to 1.0.2. The issue is an authentication/identity validation flaw in edit_newdata_customer_callback() that allows an unauthenticated attacker to change arbitrary users’ emails (including administrators), enabling pa...

CVE-2025-26910

CVE-2025-26910: WordPress WPBookit <= 1.0.1 contains a CSRF vulnerability that enables stored XSS. Affected software: WPBookit plugin (WPBookit <= 1.0.1). Remediation: patch status shows mitigation/patch applied (patched for WPBookit

CVE-2024-10215

The CVE-2024-10215 entry concerns the WPBookit WordPress plugin (versions up to and including 1.6.4). The root cause is that the plugin exposes user-controlled access to objects, allowing unauthorized users to bypass authorization and change passwords. The practical impact is that unauthenticated...

CVE-2025-6057

CVE-2025-6057 affects the WordPress plugin WPBookit, with all versions up to and including 1.0.4. The root cause is missing file type validation in handle_image_upload(), enabling authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server, potentially e...