Vulnerabilities

TI-2025-05469 CVE-2025-6057 · GHSA-68fc-7cx8-5rmc

WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 41

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00767 Published 2025-07-12 No fix listed CWE-434

TI-2025-05470 CVE-2025-6058 · GHSA-3554-wwhq-78h4

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

MEDIUM 58

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and inclu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06223 Published 2025-07-12 No fix listed CWE-434

TI-2025-03361 CVE-2025-3811 · GHSA-v5rp-5hx5-3vwq

WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update

MEDIUM 50

The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00754 Published 2025-05-09 No fix listed CWE-639

TI-2025-03360 CVE-2025-3810 · GHSA-r7x3-qhq3-x8hr

WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover

MEDIUM 50

The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00754 Published 2025-05-09 No fix listed CWE-639

TI-2025-23351 CVE-2025-32254 · GHSA-8gx6-vgfj-c5x8

WordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBookit: from n/a through <= 1.0.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00461 Published 2025-04-04 No fix listed CWE-862

TI-2025-19781 CVE-2025-26910 · GHSA-jqm9-2gmg-74hr

WordPress WPBookit plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00143 Published 2025-03-10 No fix listed CWE-352

TI-2025-00290 CVE-2025-0357 · GHSA-j5r5-3qc9-3h7c

WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload

MEDIUM 51

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in versions up to, and including, 1.6.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01073 Published 2025-01-25 No fix listed CWE-434

TI-2024-09472 CVE-2024-10215 · GHSA-wrj5-h97x-2xcg

WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change

MEDIUM 50

The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00684 Published 2025-01-09 No fix listed CWE-639

TI-2024-36369 CVE-2024-54280 · GHSA-xf3g-mfwq-4jvm

WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability

HIGH 81

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00627 Published 2024-12-16 No fix listed CWE-89

Vulnerabilities

Filters