Medium
CVE-2026-13039
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
High
CVE-2026-15070
Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
Medium
CVE-2026-11818
WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API
Medium
CVE-2026-11392
WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
Medium
CVE-2026-59523
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.11 - Missing Authorization
Medium
CVE-2026-57812
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.4 - Missing Authorization
Medium
CVE-2026-15152
Hotel Booking <= 2.3.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-12433
Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
High
CVE-2026-57388
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57404
Booking and Rental Manager <= 2.6.9 - Missing Authorization
High
CVE-2026-57702
Booking for Appointments and Events Calendar – Amelia <= 2.4.2 - Unauthenticated SQL Injection
High
CVE-2026-57713
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection
High
CVE-2026-57714
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection
Medium
CVE-2026-57395
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
High
CVE-2026-13441
EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
Medium
CVE-2026-57392
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
High
CVE-2026-6820
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field
High
CVE-2026-5356
LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
High
CVE-2026-6818
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter
High
CVE-2026-9700
Eventer <= 4.4.3 - Unauthenticated SQL Injection via 'code' Parameter
Critical
CVE-2026-9701
Eventer <= 4.4.4 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
Medium
CVE-2026-57367
WP Booking System – Booking Calendar Premium < 5.12.8.1 - Missing Authorization
Medium
CVE-2026-14842
Events Made Easy <= 3.1.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-9830
BookingPress Pro <= 5.7.2 - Missing Authorization Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.