Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: murgroland Clear all filters
TI-2026-83495 CVE-2026-116557 · GHSA-wwrg-9g45-mxcv

Missing authorization in WP Booking System allows note deletion

Priority MEDIUM 45

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00348 Published 2026-10-31 No fix listed CWE-862
TI-2026-76013 CVE-2026-108123 · GHSA-2wvw-mp72-5fwj

Missing authorization in WP Booking System exposes booking emails

Priority MEDIUM 41

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01024 Published 2026-10-17 No fix listed CWE-862
TI-2026-76022 CVE-2026-109369 · GHSA-3gjr-mw3r-975c

Missing authorization in WP Booking System allows access escalation

Priority LOW 32

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized…

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00247 Published 2026-10-17 No fix listed CWE-862
TI-2026-76021 CVE-2026-109368 · GHSA-4x57-h4wj-759x

Missing authorization in WP Booking System exposes booking data

Priority LOW 28

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00256 Published 2026-10-17 No fix listed CWE-862
TI-2026-75287 CVE-2026-111178 · GHSA-936g-2qxf-mq79

SQL injection in WP Booking System plugin via orderby parameter

Priority LOW 22

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the use…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00294 Published 2026-10-16 No fix listed CWE-89
TI-2026-70283 CVE-2026-107712 · GHSA-2mjp-56p5-fv52

SQL injection in WP Booking System WordPress plugin

Priority LOW 28

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00267 Published 2026-10-10 No fix listed CWE-89