Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Rox Appointment Booking 1.2.0 Clear all filters
TI-2026-59967 CVE-2026-87892 · GHSA-85vh-crr4-c67p

Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

Priority LOW 30

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00339 Published 2026-09-12 Fixed in 1.2.0 CWE-284
TI-2026-59966 CVE-2026-87891 · GHSA-82fg-m2x5-cqp7

Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

Priority LOW 35

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking sys…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00343 Published 2026-09-12 Fixed in 1.2.0 CWE-284