Medium
CVE-2026-39756
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-103684
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
Medium
CVE-2026-105073
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Information Exposure
High
CVE-2026-105070
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.7 - Unauthenticated Privilege Escalation
Medium
CVE-2026-105068
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure
Medium
CVE-2026-86816
WPCafe <= 3.0.20 - Unauthenticated Information Exposure
Medium
CVE-2026-39798
TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2026-94668
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-103066
WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-103352
WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Unauthenticated SQL Injection
Medium
CVE-2026-97309
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1226 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-103334
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.24 - Unauthenticated Information Exposure
Medium
CVE-2026-97304
Timetics – Appointment Booking Calendar & Scheduling <= 1.0.63 - Missing Authorization
Medium
CVE-2026-100509
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1225 - Authenticated (Customer+) Stored Cross-Site Scripting
High
CVE-2026-96809
EduAdmin Booking < 6.0.0 - Unauthenticated SQL Injection
High
CVE-2026-95591
VikBooking Hotel Booking Engine & PMS <= 1.8.14 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-75028
WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
Medium
CVE-2026-11601
WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete
Critical
CVE-2026-87115
VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
Medium
CVE-2026-39601
Booking Calendar <= 11.8.4 - Unauthenticated Duplicate Slot Booking
Medium
CVE-2026-94432
Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
High
CVE-2026-102565
BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
High
CVE-2026-93875
JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
Medium
CVE-2026-97251
Bus Ticket Booking with Seat Reservation <= 5.9.3 - Unauthenticated Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.