High
CVE-2026-66457
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-15235
MotoPress Hotel Booking < 6.0.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-16282
Appointment Hour Booking <= 1.5.87 - Unauthenticated Price Manipulation
High
CVE-2026-13395
Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection
Medium
CVE-2026-15151
Five Star Restaurant Reservations – WordPress Booking Plugin < 2.7.23 - Missing Authorization
Medium
CVE-2026-16064
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Missing Authorization
High
CVE-2026-16062
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-14214
Booking for Appointments and Events Calendar – Amelia < 2.4.4 - Missing Authorization
Medium
CVE-2026-11995
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()
Medium
CVE-2026-15403
Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter
Medium
CVE-2026-13145
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-15153
WP Hotel Booking < 2.3.2 - Authenticated (Custom role+) SQL Injection
Medium
CVE-2026-14240
Tourmaster <= 5.4.8 - Unauthenticated Information Exposure
Medium
CVE-2026-18050
Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure
High
CVE-2026-8143
HBook <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
Medium
CVE-2026-8791
Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-17166
Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
High
CVE-2026-13161
TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
High
CVE-2026-14516
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated SQL Injection
High
CVE-2026-59558
Booking Calendar <= 11.4.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16067
Event Booking Manager for WooCommerce (Pro) <= 5.0.2 - Unauthenticated Price Manipulation
High
CVE-2026-15401
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
Medium
CVE-2026-15346
VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter
Medium
CVE-2026-15464
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.