CVE-2022-1952

The CVE-2022-1952 issue affects the WordPress eaSYNC Booking plugin (Hotels/Restaurant/Car Rental) versions prior to 1.1.16. It stems from insufficient input validation of an AJAX action, with an allowlist of valid file extensions defined but not used during validation. This leads to arbitrary fi...

CVE-2025-4691

CVE-2025-4691 applies to the Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking for WordPress. The vulnerability is an Insecure Direct Object Reference that allows unauthenticated attackers to view details of any booking request via the view_request_details endpoint. Aff...

CVE-2024-9450

The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin (also identified as eaSYNC ) versions prior to 1.3.15 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings, which could allow an attacker ...