Medium
CVE-2025-58887
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2025-58633
Booking Ultra Pro <= 1.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8942
WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation
Medium
CVE-2025-9346
Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-54742
WpEvently <= 4.4.8 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-58213
Booking System Trafft <= 1.0.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-54713
Taxi Booking Manager for WooCommerce <= 1.3.0 - Missing Authorization
High
58df5dc1-c56a-43ba-ad5a-b700351b42dc
Nuss <= 1.3.3 - Unauthenticated Local File Inclusion
High
CVE-2025-58892
Tourimo <= 1.2.3 - Unauthenticated Local File Inclusion
High
CVE-2025-7813
Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery
Critical
CVE-2025-8898
Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2025-53330
WP Rentals <= 3.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-54677
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2025-54729
Webba Booking <= 6.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-52731
WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
High
CVE-2025-49869
Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-52730
WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2025-4796
Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
Medium
CVE-2025-39483
Eventer <= 3.11.2.1 - Unauthenticated Arbitrary Shortcode Execution
Critical
CVE-2025-5947
Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie
Medium
CVE-2025-54705
WpEvently <= 4.4.6 - Missing Authorization
Medium
CVE-2025-52801
TheBooking <= 1.4.4 - Missing Authorization
Medium
CVE-2025-54676
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-48142
Bookify <= 1.0.9 - Authenticated (Subscriber+) Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.