Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
WP BASE Booking of Appointments, Services and Events - Security Vulnerability (CVE-2026-123064)
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges.
PLUGIN
WP BASE Booking of Appointments, Services and Events
CVE-2026-123064
Risk Score
Threat Entry
Updated 2026-10-30
Wp Base Booking Of Appointments Services And Events - Security Vulnerability (CVE-2026-118086)
Subscriber Privilege Escalation in WP BASE Booking
PLUGIN
Wp Base Booking Of Appointments Services And Events
CVE-2026-118086
Risk Score
Threat Entry
Updated 2026-10-06
Wp Base Booking Of Appointments Services And Events - Security Vulnerability (CVE-2026-103066)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
PLUGIN
Wp Base Booking Of Appointments Services And Events
CVE-2026-103066
Risk Score
Threat Entry
Updated 2026-10-06
Wp Base Booking Of Appointments Services And Events - Security Vulnerability (CVE-2026-103352)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
PLUGIN
Wp Base Booking Of Appointments Services And Events
CVE-2026-103352
Risk Score
Threat Entry
Updated 2026-10-24
Wp Base Booking Of Appointments Services And Events - Remote Code Execution (CVE-2026-61962)
Unauthenticated Arbitrary Code Execution in WP BASE Booking
PLUGIN
Wp Base Booking Of Appointments Services And Events
CVE-2026-61962
Risk Score
Threat Entry
Updated 2026-06-17
WP BASE Booking of Appointments, Services and Events - Cross-Site Scripting (XSS) (CVE-2024-12737)
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
WP BASE Booking of Appointments, Services and Events
CVE-2024-12737
Risk Score
Threat Entry
Updated 2026-06-17
Wp Base Booking Of Appointments Services And Events - Cross-Site Scripting (XSS) (CVE-2025-22684)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hakan Ozevin WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Stored XSS.This issue affects WP BASE Booking: from n/a through
PLUGIN
Wp Base Booking Of Appointments Services And Events
CVE-2025-22684
Risk Score
Threat Entry
Updated 2026-06-17
WP BASE Booking of Appointments, Services and Events - Information Disclosure (CVE-2024-12558)
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password.
PLUGIN
WP BASE Booking of Appointments, Services and Events
CVE-2024-12558
Risk Score
Threat Entry
Updated 2026-06-17
WP BASE Booking of Appointments, Services and Events - Cross-Site Scripting (XSS) (CVE-2024-12469)
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
WP BASE Booking of Appointments, Services and Events
CVE-2024-12469
Risk Score