CVE-2022-1952

The CVE-2022-1952 issue affects the WordPress eaSYNC Booking plugin (Hotels/Restaurant/Car Rental) versions prior to 1.1.16. It stems from insufficient input validation of an AJAX action, with an allowlist of valid file extensions defined but not used during validation. This leads to arbitrary fi...

CVE-2025-4691

CVE-2025-4691 applies to the Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking for WordPress. The vulnerability is an Insecure Direct Object Reference that allows unauthenticated attackers to view details of any booking request via the view_request_details endpoint. Aff...

CVE-2024-9450

The Free Booking Plugin for Hotels, Restaurants and Car Rentals (also referred to as eaSYNC ) for WordPress is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.3.15 . The root cause is a missing CSRF check when updating plugin settings. An attacker could trick a log...