Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filtersOnline Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload
Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting
EventPrime <= 2.8.6 - Reflected Cross-Site Scripting
EventPrime <= 2.8.6 - Sensitive Information Exposure
EventPrime <= 3.0.5 - Reflected Cross-Site Scripting
WooCommerce Bookings <= 1.15.78 - Insecure Direct Object Reference
Booking Ultra Pro <= 1.1.6 - Missing Authorization via save_fields_settings
Bookly <= 21.7.1 - Arbitrary File Deletion
Booking Ultra Pro <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
Booking Ultra Pro <= 1.1.8 - Reflected Cross-Site Scripting
Hostel <= 1.1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Manage Bookings
Booking Manager <= 2.0.28 - Authenticated (Subscriber+) Server-Side Request Forgery
Booking calendar, Appointment Booking System <= 3.2.6 - Authenticated (Administrator+) SQL Injection via *_selected
Yatra <= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
Avirato hotels online booking engine <= 5.0.5 - Authenticated (Subscriber+) SQL Injection
Amelia <= 1.0.75 - Unauthenticated Reflected Cross-Site Scripting via 'code'
WP FEvents Book <= 0.46 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Manipulation
Event Manager for WooCommerce <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function
Bookly <= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.