Medium
CVE-2026-78291
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-18779
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
Medium
CVE-2026-18778
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-14853
WooCommerce Bookings <= 3.8.0 - Missing Authorization
High
CVE-2026-18776
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation
Medium
CVE-2026-18777
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
Medium
CVE-2026-73402
WP BASE Booking of Appointments, Services and Events <= 6.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-68566
BookingPress Appointment Booking Pro <= 6.0.6 - Unauthenticated SQL Injection
Medium
CVE-2026-73363
E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization
High
CVE-2026-73347
TrueBooker – Appointment Booking and Scheduler System <= 1.2.6 - Unauthenticated Privilege Escalation
Critical
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
High
CVE-2026-73365
JetAppointment <= 2.5.2 - Unauthenticated SQL Injection
Medium
CVE-2026-66679
Appointment Hour Booking – Booking Calendar <= 1.5.94 - Missing Authorization
Medium
CVE-2026-73395
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-32466
Gravity Bookings <= 2.1 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-14334
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-13174
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
Medium
CVE-2026-13173
Eventin <= 4.1.20 - Missing Authorization
Medium
CVE-2026-13169
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
Medium
CVE-2026-13175
Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification
High
CVE-2026-13424
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
High
CVE-2026-17087
WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter
Medium
CVE-2026-13358
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Medium
CVE-2026-12905
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.