sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total12
Critical0
High6
Medium6
Reset
Showing 1-12 of 12 records
Threat Entry Updated 2026-10-03

Ba Book Everything - Security Vulnerability (CVE-2026-102565)

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator or other privileged user opens the injected order record in the plugin's wp-admin order management area, which is the plugin's ordinary order-review workflow.

PLUGIN Ba Book Everything

CVE-2026-102565

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-09-25

Ba Book Everything - Security Vulnerability (CVE-2026-96039)

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit…

PLUGIN Ba Book Everything

CVE-2026-96039

HIGH CVSS 7.2 2026-09-25
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Ba Book Everything - Cross-Site Scripting (XSS) (CVE-2025-14449)

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's babe-search-form shortcode in all versions up to, and including, 1.8.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Ba Book Everything

CVE-2025-14449

MEDIUM CVSS 6.4 2025-12-19
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Ba Book Everything - Privilege Escalation (CVE-2024-8794)

The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user's passwords, including administrators. It's important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.

PLUGIN Ba Book Everything

CVE-2024-8794

MEDIUM CVSS 5.3 2024-09-24
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Ba Book Everything - Cross-Site Request Forgery (CSRF) (CVE-2024-8795)

The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthenticated attackers to update a user's account details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to reset a user's password and gain access to their account.

PLUGIN Ba Book Everything

CVE-2024-8795

HIGH CVSS 8.8 2024-09-24
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Ba Book Everything - Cross-Site Scripting (XSS) (CVE-2024-3672)

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32576 is likely a duplicate of this issue.

PLUGIN Ba Book Everything

CVE-2024-3672

MEDIUM CVSS 6.4 2024-04-16
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.