Medium
CVE-2026-62063
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
High
CVE-2026-96573
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
Critical
CVE-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
Medium
CVE-2026-91109
Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
Medium
CVE-2026-96886
Course Booking System <= 7.0.8 - Unauthenticated Information Exposure
High
CVE-2026-97248
Booking Activities <= 1.18.7.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-86837
Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-86839
Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference
High
CVE-2026-86841
Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection
Medium
CVE-2026-86838
Bookly <= 28.2 - Unauthenticated Payment Bypass
Critical
CVE-2026-93399
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
Medium
CVE-2026-92799
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
High
CVE-2026-96039
BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter
Medium
CVE-2026-97079
Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-96347
Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-96348
Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization
Medium
CVE-2026-95513
Online Booking & Scheduling Calendar by vcita <= 4.6.0 - Missing Authorization
Medium
CVE-2026-93661
Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-93662
Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-9231
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
Medium
CVE-2026-93655
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Medium
CVE-2026-91024
Booking Manager <= 2.1.20 - Authenticated (Author+) SQL Injection
Medium
CVE-2026-91077
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Missing Authorization
Medium
CVE-2026-91025
Booking Manager <= 2.1.20 - Authenticated (Subscriber+) Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.