Critical
CVE-2026-16142
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-15948
Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
Medium
CVE-2026-12128
Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
Medium
CVE-2026-8840
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
High
CVE-2026-14433
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
Medium
CVE-2026-14213
Booking for Appointments and Events Calendar – Amelia < 2.4.6 - Authenticated (Custom role+) Information Exposure
Medium
CVE-2026-13177
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-28173
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion
High
CVE-2026-14239
Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28176
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
Medium
CVE-2025-10308
Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
Medium
CVE-2026-13168
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
High
CVE-2026-28161
Service Finder Bookings <= 6.2 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-28159
Service Finder Booking <= 6.2 - Missing Authorization
Medium
CVE-2026-28188
Hydra Booking <= 1.2.2 - Missing Authorization
Medium
CVE-2026-28174
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
Medium
CVE-2026-28002
Booktics 1.0.22 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-27380
Car Rental Manager <= 1.3.9 - Authenticated (Editor+) PHP Object Injection
Critical
CVE-2026-61962
WP BASE Booking of Appointments, Services and Events <= 6.3.0 - Unauthenticated Remote Code Execution
Medium
CVE-2026-27999
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization
Medium
CVE-2026-66687
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.3.2 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-27345
E-cab Taxi Booking Manager for Woocommerce <= 2.0.3 - Missing Authorization
High
CVE-2026-18366
Events Manager <= 7.4.0 - Unauthenticated Privilege Escalation
Medium
CVE-2026-11887
Salon Booking System <= 10.30.19 - Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.