Threat Database

Threat Entry Updated 2026-06-17

Booking Ultra Pro - Information Disclosure (CVE-2025-68006)

Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through

PLUGIN Booking Ultra Pro

CVE-2025-68006

MEDIUM CVSS 6.5 2026-01-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro - Cross-Site Scripting (XSS) (CVE-2025-58633)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through

PLUGIN Booking Ultra Pro

CVE-2025-58633

MEDIUM CVSS 6.5 2025-09-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro - Cross-Site Scripting (XSS) (CVE-2025-30637)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through

PLUGIN Booking Ultra Pro

CVE-2025-30637

MEDIUM CVSS 5.9 2025-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro - Cross-Site Scripting (XSS) (CVE-2025-27345)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Reflected XSS.This issue affects Booking Ultra Pro: from n/a through

PLUGIN Booking Ultra Pro

CVE-2025-27345

HIGH CVSS 7.1 2025-04-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro - Broken Access Control (CVE-2023-32601)

Missing Authorization vulnerability in Booking Ultra Pro Booking Ultra Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Ultra Pro: from n/a through 1.1.12.

PLUGIN Booking Ultra Pro

CVE-2023-32601

MEDIUM CVSS 5.4 2024-12-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro - Broken Access Control (CVE-2024-6175)

The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like save_fields_settings, bup_delete_user_avatar, bup_crop_avatar_user_profile_image, and more in all versions up to, and including, 1.1.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify and delete. multiple plugin options and data such as payments, pricing, booking information, business hours, calendars, profile information, and email templates.

PLUGIN Booking Ultra Pro

CVE-2024-6175

MEDIUM CVSS 5.4 2024-07-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro - Cross-Site Scripting (XSS) (CVE-2021-36855)

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin

PLUGIN Booking Ultra Pro

CVE-2021-36855

MEDIUM CVSS 6.1 2022-09-30

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Booking Ultra Pro plugin - Cross-Site Request Forgery (CSRF) (CVE-2021-36854)

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin

PLUGIN Booking Ultra Pro plugin

CVE-2021-36854

MEDIUM CVSS 5.4 2022-09-30

Risk Score

Open Full Technical Breakdown