High
CVE-2026-7332
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-7457
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
High
CVE-2026-6320
Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
Medium
CVE-2026-6449
Booking for Appointments and Events Calendar – Amelia <= 2.2.1 - Unauthenticated Authorization Bypass via Remote Approval Endpoint
High
CVE-2026-2554
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
Medium
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Medium
CVE-2026-6498
Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter
Medium
CVE-2026-40776
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization
Medium
CVE-2026-40795
Booking for Appointments and Events Calendar – Amelia <= 2.2 - Missing Authorization
Medium
CVE-2026-4911
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
High
CVE-2026-6741
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
Medium
CVE-2026-42384
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.11.2 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-6810
Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
Medium
CVE-2025-69332
Bookify – Appointment Booking & Scheduling for WordPress <= 1.1.1 - Missing Authorization
High
CVE-2026-40791
WP Time Slots Booking Form <= 1.2.46 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28040
E-cab Taxi Booking Manager for Woocommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-40789
Booking for Appointments and Events Calendar – Amelia <= 2.2 - Unauthenticated Information Exposure
Medium
CVE-2026-40780
Bookit — Booking & Appointment Calendar <= 2.5.1 - Missing Authorization
Medium
CVE-2026-40768
Salon Booking System – Free Version <= 10.30.24 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-40774
Booking Package <= 1.7.06 - Missing Authorization
Medium
CVE-2026-39584
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1132 - Missing Authorization
Medium
CVE-2026-39518
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-5234
LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
Medium
CVE-2026-4109
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.