Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Rox Appointment Booking 1.2.8 Clear all filters
TI-2026-59974 CVE-2026-87907 · GHSA-342g-5r7c-c49c

Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

Priority LOW 30

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-09-16 Fixed in 1.2.8 CWE-200
TI-2026-59969 CVE-2026-87896 · GHSA-9rh9-m7f7-q2g2

Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

Priority LOW 30

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addres…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-09-16 Fixed in 1.2.8 CWE-200