Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-18
Bookit - Security Vulnerability (CVE-2026-89008)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.
PLUGIN
Bookit
CVE-2026-89008
Risk Score
Threat Entry
Updated 2026-09-18
Bookit - Security Vulnerability (CVE-2026-89007)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
PLUGIN
Bookit
CVE-2026-89007
Risk Score
Threat Entry
Updated 2026-09-14
Bookit - Security Vulnerability (CVE-2026-88995)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
PLUGIN
Bookit
CVE-2026-88995
Risk Score
Threat Entry
Updated 2026-09-04
Bookit - Security Vulnerability (CVE-2026-84767)
Unauthenticated Bypass Vulnerability in BookIt
PLUGIN
Bookit
CVE-2026-84767
Risk Score
Threat Entry
Updated 2026-07-22
Bookit - Authentication Bypass (CVE-2026-40780)
Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.
PLUGIN
Bookit
CVE-2026-40780
Risk Score
Threat Entry
Updated 2026-06-17
Bookit - Security Vulnerability (CVE-2025-12841)
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
PLUGIN
Bookit
CVE-2025-12841
Risk Score
Threat Entry
Updated 2026-06-17
Bookit - Broken Access Control (CVE-2025-12633)
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to connect their Stripe account and receive payments.
PLUGIN
Bookit
CVE-2025-12633
Risk Score
Threat Entry
Updated 2026-06-17
Bookit - SQL Injection (CVE-2023-50852)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.
PLUGIN
Bookit
CVE-2023-50852
Risk Score
Threat Entry
Updated 2026-06-17
Bookit - Authentication Bypass (CVE-2023-2834)
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
PLUGIN
Bookit
CVE-2023-2834
Risk Score