CVE-2019-12239

The CVE-2019-12239 entry concerns the WordPress WP Booking System plugin (version 1.5.1) with a lack of CSRF protection, which allows reaching SQL injection issues that require administrative access. Connected documents confirm this vulnerability and its remediation guidance, e.g., Patchstack and...

CVE-2021-25061

CVE-2021-25061: WordPress WP Booking System plugin before 2.0.15 suffers a reflected XSS on the wpbs-calendars admin page. The vulnerability is authenticated (requires user login) and can execute JavaScript in the context of the affected site. Evidence across multiple sources confirms the flaw an...

CVE-2024-8797

The CVE-2024-8797 entry concerns the WP Booking System – Booking Calendar WordPress plugin. Affected versions up to and including 2.0.19.8 are vulnerable to Reflected Cross-Site Scripting due to improper escaping when using add_query_arg/remove_query_arg in the URL, enabling unauthenticated attac...