Medium
CVE-2026-1607
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-39525
Booking Activities <= 1.16.48.1 - Missing Authorization
Medium
CVE-2026-2519
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
Critical
CVE-2026-39587
WP BASE Booking of Appointments, Services and Events <= 5.9.0 - Unauthenticated Privilege Escalation
High
CVE-2026-39493
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection
High
CVE-2026-39539
Alloggio - Hotel Booking WordPress Theme <= 2.1.2 - Unauthenticated PHP Object Injection
Medium
CVE-2026-4785
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-39432
Timetics – Appointment Booking & Scheduling <= 1.0.53 - Missing Authorization
High
CVE-2026-5465
Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
Medium
CVE-2026-2437
WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode
High
CVE-2026-4896
WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Medium
CVE-2026-4668
Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
Medium
CVE-2026-1797
Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
Medium
CVE-2026-39543
Tourfic <= 2.21.4 - Missing Authorization
High
CVE-2026-2931
Amelia Booking 8.3 - 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
Medium
CVE-2026-39487
Amelia <= 2.1.1 - Authenticated (Custom role+) SQL Injection
High
CVE-2026-2231
Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
Medium
CVE-2026-32533
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-25414
WPBookit Pro <= 1.6.18 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-25413
WPBookit Pro <= 1.6.18 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-23972
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.6.0 - Missing Authorization
Medium
CVE-2026-25334
Salon Booking System Pro < 10.30.12 - Missing Authorization
Medium
CVE-2026-25327
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.9 - Missing Authorization
Medium
CVE-2026-39572
Bus Ticket Booking with Seat Reservation < 5.6.5 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.