Advisories · Technology
murgroland WP Booking System – Booking Calendar.
Every CVE that names murgroland WP Booking System – Booking Calendar among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 7.5 High
WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 6.8 Medium
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 6.5 Medium
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 4.9 Medium
WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- murgroland WP Booking System – Booking Calendar
- SQL injection
- CVSS 6.5 Medium
WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
- murgroland WP Booking System – Booking Calendar
- SQL injection
- CVSS 6.1 Medium
WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
- murgroland WP Booking System – Booking Calendar
- Cross-site scripting (XSS)