CVE-2022-0739

BookingPress (WordPress) has a SQL injection in versions before 1.0.11 via the unauthenticated bookingpress_front_get_category_services AJAX action. The vulnerability stems from improper sanitization of user-supplied data used to build a dynamic SQL query, enabling unauthenticated disclosure of b...

CVE-2025-31910

Technical details for CVE-2025-31910 are not provided in the Connected documents. The Initial Description notes a SQL Injection in BookingPress

CVE-2023-6219

CVE-2023-6219 affects the BookingPress – Appointment Booking Calendar Plugin for WordPress. It allows authenticated administrators (or higher) to upload arbitrary files via the bookingpress_process_upload function due to insufficient input validation, up to and including version 1.0.76, with pote...

CVE-2023-51405

CVE-2023-51405 concerns the WordPress plugin BookingPress prior to version 1.0.75, where unauthenticated users could manipulate the booking price due to an improper validation in the bookingpress_confirm_booking flow. Affected versions are BookingPress up to 1.0.74; the vulnerability enables pric...

CVE-2024-3022

BookingPress for WordPress (all versions

CVE-2024-6467

BookingPress (Appointment Booking Calendar & Scheduling plugin for WordPress) is affected by CVE-2024-6467 and related disclosures. The vulnerability stems from the function bookingpress_save_lite_wizard_settings_func() which saves wizard settings without proper capability checks, and with a publ...

CVE-2025-24732

CVE-2025-24732 : BookingPress plugin (WordPress) ≤ 1.1.25 suffers DOM-based XSS due to improper input neutralization during page generation. Exploitation could affect pages rendered via BookingPress. Public references list patch availability; Red Hat/NVD entries confirm the vulnerability. Remedia...

CVE-2024-6660

BookingPress (Appointment Booking Calendar Plugin for WordPress) is affected up to version 1.1.5 . The vulnerability stems from a missing capability check in the bookingpress_import_data_continue_process_func and publicly accessible nonce on the frontend, allowing authenticated users with Subscri...

CVE-2023-50841

CVE-2023-50841 denotes an SQL Injection in BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin by Repute Infosystems. Affected versions are listed as from n/a through 1.0.72. The Red Hat advisory confirms the flaw (improper neutralization of input in SQL) and states th...

CVE-2022-4340

BookingPress WordPress plugin (versions before 1.0.31) is affected by an Insecure Direct Object Reference (IDOR) in the thank-you page. The underlying issue enables unauthenticated users to view booking details (full name, date, time, service) by altering the appointment_id parameter. Reported in...

CVE-2024-31296

CVE-2024-31296 refers to an Authorization Bypass via a user-controlled key in BookingPress (BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin). Connected Red Hat advisory confirms the vulnerability affects BookingPress versions up to 1.0.81 and describes an Authoriza...

CVE-2024-34799

CVE-2024-34799 is a Missing Authorization vulnerability in the BookingPress WordPress plugin, affecting BookingPress versions n/a–1.0.82. The issue allows an attacker to alter appointment times without authorization. Wordfence details indicate the vulnerability exists in BookingPress and has a pa...

CVE-2024-10540

CVE-2024-10540 affects the BookingPress plugin for WordPress (BookingPress/Appointment Booking Calendar) up to version 1.1.16. The vulnerability is a SQL Injection via the service parameter of the bookingpress_form shortcode caused by insufficient escaping and unsafe SQL query construction. Authe...

CVE-2023-36507

Summary (CVE-2023-36507) : Affected software is the BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin for WordPress. The issue is an unauthenticated information disclosure in BookingPress versions up to and including 1.0.64, caused by exposure of sensitive server inf...