Veille CVE

Recherche « Unknown Appointment Booking Calendar Plugin and Scheduling Plugin »

5 CVE

Critique 0 Élevée 2 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Appointment Booking Calendar Plugin and Scheduling Plugin » ✕
  1. CVE-2026-92425 5.5 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

  2. CVE-2026-92421 4.7 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

  3. CVE-2026-92420 3.8 Faible

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

  4. CVE-2026-76586 7.5 Élevée

    Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

    The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

  5. CVE-2026-12378 8.1 Élevée

    Unknown Appointment Booking Calendar Plugin and Scheduling Plugin

    The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.