wp_booking_system vulnerabilities
CVEs whose affected-version data names the wp_booking_system package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-109147NoneWP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege us…
▾ Sunlitvia CVEORG
CVE-2026-107126High· 8.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform …
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform …
▾ TwilightEPSS 0.46%via NVD