Vulnerabilities

TI-2023-20817 CVE-2023-39918 · GHSA-8hgm-54v7-vqj3

WordPress Booking Package Plugin <= 1.6.01 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SAASPROJECT Booking Package Booking Package plugin <= 1.6.01 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0039 Published 2023-09-04 No fix listed CWE-79

TI-2022-00623 CVE-2022-0709 · GHSA-24jf-3vhr-fw23

Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure

LOW 36

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a bo…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01619 Published 2022-04-04 Fixed in 1.5.29 CWE-200

TI-2021-04055 CVE-2021-20840 · GHSA-6wcx-352r-rcj5

Cross-site scripting in SaasProject Booking Package - Appointment Booking Calendar System

LOW 30

Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01284 Published 2021-11-24 Fixed in 1.5.11 CWE-79

Vulnerabilities

Filters

WordPress Booking Package Plugin <= 1.6.01 is vulnerable to Cross Site Scripting (XSS)

Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure

Cross-site scripting in SaasProject Booking Package - Appointment Booking Calendar System