Medium
CVE-2026-57638
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-57660
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 - Missing Authorization
Medium
CVE-2026-12393
WPS Bookings for WooCommerce <= 3.11.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Cancellation
High
CVE-2026-57317
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-56064
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-57622
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.14 - Missing Authorization
Medium
CVE-2026-11866
LatePoint <= 5.6.2 - Cross-Site Request Forgery
High
CVE-2026-56053
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-56059
Travel Booking <= 2.2.5 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-12937
Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter
Medium
CVE-2026-2508
Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'
High
CVE-2026-56040
Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-9822
WP Hotel Booking < 2.3.1 - Missing Authorization
Medium
CVE-2026-1856
Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
Medium
CVE-2026-12111
Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
High
CVE-2026-12378
BookingPress <= 1.5.5 - Unauthenticated PHP Object Injection
High
CVE-2026-54820
JetBooking <= 4.0.4.1 - Unauthenticated SQL Injection
Medium
CVE-2026-54830
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 - Missing Authorization
Medium
CVE-2026-10834
Travel Engine <= 6.8.0 - Authenticated (Subscriber+) Arbitrary Media File Move
High
CVE-2026-8176
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
Medium
CVE-2025-68045
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization
Medium
CVE-2016-20070
Booking Calendar Contact Form <= 1.0.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2016-20084
Booking Calendar Contact Form <= 1.1.24 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2016-20079
Dharma Booking <= 2.28.3 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.