Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Booking Package - Security Vulnerability (CVE-2026-106000)
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
PLUGIN
Booking Package
CVE-2026-106000
Risk Score
Threat Entry
Updated 2026-10-10
Booking Package - Security Vulnerability (CVE-2026-105995)
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
PLUGIN
Booking Package
CVE-2026-105995
Risk Score
Threat Entry
Updated 2026-08-26
Booking Package - Improper Input Validation (CVE-2026-16986)
The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
PLUGIN
Booking Package
CVE-2026-16986
Risk Score
Threat Entry
Updated 2026-07-14
Booking Package - SQL Injection (CVE-2026-15335)
The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable REST API endpoint /wp-json/booking-package/v1/request is registered with permission_callback: __return_true and wp_magic_quotes does not apply to REST-sourced $_POST…
PLUGIN
Booking Package
CVE-2026-15335
Risk Score
Threat Entry
Updated 2026-06-17
Booking Package - Broken Access Control (CVE-2026-40774)
Unauthenticated Broken Access Control in Booking Package
PLUGIN
Booking Package
CVE-2026-40774
Risk Score
Threat Entry
Updated 2026-07-23
Booking Package - Privilege Escalation (CVE-2026-9851)
The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level…
PLUGIN
Booking Package
CVE-2026-9851
Risk Score
Threat Entry
Updated 2026-06-17
Booking Package - Security Vulnerability (CVE-2026-4911)
The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignoring the server-calculated amount when confirming the payment. While the server correctly calculates the booking cost via getAmount() based on services, guests, taxes, and coupons, this calculated amount is never validated against or used to update the PaymentIntent because the critical code in CreditCard.php that would include the calculated amount…
PLUGIN
Booking Package
CVE-2026-4911
Risk Score
Threat Entry
Updated 2026-06-17
Booking Package - Improper Input Validation (CVE-2024-30516)
Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n/a through 1.6.27.
PLUGIN
Booking Package
CVE-2024-30516
Risk Score
Threat Entry
Updated 2026-06-17
Booking Package - Cross-Site Scripting (XSS) (CVE-2024-13508)
The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Booking Package
CVE-2024-13508
Risk Score
Threat Entry
Updated 2026-06-17
Booking Package - Cross-Site Scripting (XSS) (CVE-2023-39918)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SAASPROJECT Booking Package Booking Package plugin
PLUGIN
Booking Package
CVE-2023-39918
Risk Score
Threat Entry
Updated 2026-06-17
Booking Package - Security Vulnerability (CVE-2022-0709)
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
PLUGIN
Booking Package
CVE-2022-0709
Risk Score
Threat Entry
Updated 2026-06-17
Booking Package - Cross-Site Scripting (XSS) (CVE-2021-20840)
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.
PLUGIN
Booking Package
CVE-2021-20840
Risk Score