Veille CVE

Recherche « Unknown WooCommerce Bookings »

4 CVE

Critique 0 Élevée 1 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown WooCommerce Bookings » ✕
  1. CVE-2026-14854 7.5 Élevée

    Unknown WooCommerce Bookings

    The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.

  2. CVE-2026-14853 4.3 Moyenne

    Unknown WooCommerce Bookings

    The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

  3. CVE-2026-16067 5.3 Moyenne

    Unknown Event Booking Manager for WooCommerce (Pro)

    The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

  4. CVE-2026-12393 5.4 Moyenne

    Unknown WPS Bookings for WooCommerce

    The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.