Read the docs

Booking-wp-plugin

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

Booking-wp-plugin records in CISA KEV

No Booking-wp-plugin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Bookly 6 records HIGH

Records

6 records in Bookly · all components

TI-2023-04323 CVE-2023-4691 · GHSA-p3m2-9555-cgrw

Bookly < 22.4 - Admin+ SQLi

Priority HIGH 67

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privile…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00902 Published 2023-10-16 Fixed in 22.4
TI-2021-07209 CVE-2021-24930 · GHSA-jhv5-5gxp-jg64

Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

Priority LOW 25

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2021-12-06 Fixed in 20.3.1 CWE-79
TI-2023-04793 CVE-2023-5209 · GHSA-hgwf-985j-mh3j

Bookly < 22.5 - Admin+ Stored XSS

Priority LOW 22

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00451 Published 2023-11-27 Fixed in 22.5 CWE-79
Open these records in search →