CVEs we hold for Booking
Records whose assigning authority named Booking as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-9830BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback BugUnknown bookingpress-appointment-booking-pro
CVE-2026-77705Amelia < 2.4.10 - Amelia Manager+ WordPress Account TakeoverUnknown Booking for Appointments and Events Calendar
CVE-2026-77704Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-ApprovalUnknown Booking for Appointments and Events Calendar
CVE-2026-77689Amelia Pro 9.0 - 9.8 - Unauthenticated Payment BypassUnknown Booking for Appointments and Events Calendar
CVE-2026-66462WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerabilityBookingWP WooCommerce Appointments
CVE-2026-39525WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerabilityBooking Activities
CVE-2026-28176WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerabilityBooking Activities
CVE-2026-24371WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerabilitybookingalgorithms BA Book Everything
CVE-2026-16986Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost ParametersUnknown Booking Package
CVE-2026-14334Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File UploadUnknown Booking calendar, Appointment Booking System
CVE-2026-14216Amelia < 2.4.7 - Unauthenticated Notification Queue DispatchUnknown Booking for Appointments and Events Calendar
CVE-2026-14215Amelia < 2.4.9 - Unauthenticated Post-Booking Action TriggerUnknown Booking for Appointments and Events Calendar
CVE-2026-14214Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass AssignmentUnknown Booking for Appointments and Events Calendar
CVE-2026-14213Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDORUnknown Booking for Appointments and Events Calendar
CVE-2026-14212Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDORUnknown Booking for Appointments and Events Calendar
CVE-2026-14211Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDORUnknown Booking for Appointments and Events Calendar
CVE-2025-67953WordPress Booking Activities plugin <= 1.16.44 - Privilege Escalation vulnerabilityBooking Activities
CVE-2025-14449BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcodebookingalgorithms BA Book Everything
CVE-2024-8795BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeoverbookingalgorithms BA Book Everything
CVE-2024-8794BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Resetbookingalgorithms BA Book Everything
CVE-2024-47360WordPress BA Book Everything plugin <= 1.6.20 - Reflected Cross Site Scripting (XSS) vulnerabilitybookingalgorithms BA Book Everything
CVE-2024-38717WordPress Booking Ultra Pro Appointments Booking Calendar plugin <= 1.1.13 - Local File Inclusion vulnerabilityBooking Ultra Pro
CVE-2024-38676WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.13 - Cross Site Scripting (XSS)…Booking Ultra Pro
CVE-2024-3672BA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebookingalgorithms BA Book Everything
CVE-2024-32960WordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerabilityBooking Ultra Pro
CVE-2024-32598WordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityBooking Algorithms BA Book Everything
CVE-2024-32576WordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityBooking Algorithms BA Book Everything
CVE-2024-32125WordPress BA Book Everything plugin <= 1.6.4 - Auth. SQL Injection vulnerabilityBooking Algorithms BA Book Everything
CVE-2024-30449WordPress Booking Activities plugin <= 1.15.19 - Cross Site Scripting (XSS) vulnerabilityBooking Activities
CVE-2023-32601WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.12 - Broken Access Control vulnerabilityBooking Ultra Pro
CVE-2023-32511WordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)Booking Calendar Plugin
CVE-2023-32236WordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)Booking Calendar Plugin
CVE-2022-46816WordPress Booking Ultra Pro Plugin <= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF)Booking Calendar Plugin
CVE-2022-3982Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File UploadUnknown Booking calendar, Appointment Booking System
CVE-2022-0739BookingPress < 1.0.11 - Unauthenticated SQL InjectionUnknown BookingPress – Appointments Booking Calendar Plugin…
CVE-2022-0709Booking Package < 1.5.29 - Unauthenticated Sensitive Data DisclosureUnknown Booking Package – Appointment Booking Calendar…
CVE-2021-36855WordPress Booking Ultra Pro plugin <= 1.1.4 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF)…Booking Ultra Pro (WordPress plugin)
CVE-2021-36854WordPress Booking Ultra Pro plugin <= 1.1.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesBooking Ultra Pro (WordPress plugin)
CVE-2021-24646Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site ScriptingUnknown Booking.com Banner Creator
CVE-2021-24645Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site ScriptingUnknown Booking.com Product Helper
47 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.