Vulnerabilities

TI-2024-08163 CVE-2024-8797 · GHSA-6hmq-m3mm-wvrh

WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting

LOW 28

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00504 Published 2024-09-14 No fix listed CWE-79

TI-2023-10024 CVE-2023-24402 · GHSA-vwqg-h7r8-fqcg

WordPress WP Booking System Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Veribo, Roland Murg WP Booking System – Booking Calendar plugin <= 2.0.18 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00394 Published 2023-04-07 No fix listed CWE-79

TI-2021-07339 CVE-2021-25061 · GHSA-vmjf-9395-7q9j

WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)

LOW 26

The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00675 Published 2022-01-17 Fixed in 2.0.15 CWE-79

TI-2019-09130 CVE-2019-12239 · GHSA-m27g-fr8f-5p8f

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows…

LOW 33

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00894 Published 2019-05-20 No fix listed CWE-352

TI-2017-01469 CVE-2017-2168 · GHSA-85h6-fq5p-43qv

Cross-site scripting in WP Booking System Free version

LOW 30

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unsp…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01379 Published 2017-05-22 No fix listed CWE-79