Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Booking Manager 2.1.21 Clear all filters
TI-2026-61860 CVE-2026-91025 · GHSA-f2f6-fww5-gh59

Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

Priority LOW 20

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing an…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-09-23 Fixed in 2.1.21 CWE-639
TI-2026-61859 CVE-2026-91024 · GHSA-8743-f7m5-qxwx

Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

Priority LOW 30

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00391 Published 2026-09-23 Fixed in 2.1.21 CWE-89