Veille CVE

Recherche « Unknown Appointment Booking Plugin »

11 CVE

Critique 0 Élevée 1 Moyenne 5 Faible 5 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Appointment Booking Plugin » ✕
  1. CVE-2026-105256 5.3 Moyenne

    Unknown LatePoint

    The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.

  2. CVE-2026-105257 2.7 Faible

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.

  3. CVE-2026-94229 5.3 Moyenne

    Unknown TrueBooker

    The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.

  4. CVE-2026-105198 5.3 Moyenne

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.

  5. CVE-2026-105197 2.7 Faible

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.

  6. CVE-2026-105196 3.3 Faible

    Unknown Appointment Booking Plugin

    The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.

  7. CVE-2026-86838 5.3 Moyenne

    Unknown Bookly

    The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

  8. CVE-2026-86841 4.7 Moyenne

    Unknown Online Scheduling and Appointment Booking System

    The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.

  9. CVE-2026-86839 3.8 Faible

    Unknown Online Scheduling and Appointment Booking System

    The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.

  10. CVE-2026-19406 2.7 Faible

    Unknown Easy Appointments

    The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.

  11. CVE-2026-14334 8.8 Élevée

    Unknown Booking calendar, Appointment Booking System

    The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.