Medium
CVE-2026-39565
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
High
CVE-2026-3003
Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'
Medium
CVE-2026-3567
RepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action
Medium
CVE-2026-32540
Online Scheduling and Appointment Booking System – Bookly <= 26.7 - Reflected Cross-Site Scripting
Medium
CVE-2026-25361
Event Booking Manager for WooCommerce <= 5.1.4 - Reflected Cross-Site Scripting
High
CVE-2026-3658
Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter
Medium
CVE-2026-25312
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization
High
CVE-2026-25435
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-25449
Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection
High
CVE-2026-24378
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection
High
CVE-2026-3045
Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
Medium
CVE-2026-1704
Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
Medium
CVE-2025-15473
Timetics – Appointment Booking Calendar & Scheduling System < 1.0.52 - Missing Authorization
Medium
CVE-2026-1753
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder < 1.6.1 - Missing Authorization to Authenticated (Contributor+) Settings Update
Medium
CVE-2026-27071
WPCafe – Restaurant Menu, Online Food Ordering and Reservation Booking Solution <= 3.0.7 - Missing Authorization
High
CVE-2026-1708
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
High
CVE-2026-3496
JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter
Medium
CVE-2026-2324
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
Medium
CVE-2025-69358
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.6.0 - Missing Authorization
Medium
CVE-2026-1919
Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
Medium
CVE-2026-1920
Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
High
CVE-2026-27095
Bus Ticket Booking with Seat Reservation <= 5.6.2 - Unauthenticated PHP Object Injection
High
CVE-2026-27093
Tripgo < 1.5.6 - Unauthenticated Local File Inclusion
High
CVE-2026-24963
Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Authenticated (Employee+) Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.